https://community.splunk.com/t5/Getting-Data-In/Question-about-using-virtual-machines-for-intermediate/m-p/54093#M10461 <P>Yes, a VM for an intermediate forwarder should be fine, though you can probably use LWF just fine, as WMI shouldn't have any problems with buffered writes.</P> Sat, 05 Mar 2011 07:59:06 GMT gkanapathy 2011-03-05T07:59:06Z https://community.splunk.com/t5/Getting-Data-In/Question-about-using-virtual-machines-for-intermediate/m-p/54092#M10460 <P>Hello folks,</P> <P>I'm trying to puzzle out getting around SPL-34965 (WMI not load balancing), not inundating a single indexer (which is happening right now and screwing up my licensing) and keeping the the networking people happy by not asking for too many external IPs. I see that using an intermediate forwarder (HWF to avoid the done-key issue) is a solution. I completely understand why I wouldn't want to go virtual with the indexers and search head. But, can I get away with going virtual with intermediate forwarders? Does anyone have any anecdotal evidence? </P> <P>We have about 725 LWFs sending to 3 indexers. </P> <P>Thanks in advance.</P> Sat, 05 Mar 2011 01:39:16 GMT https://community.splunk.com/t5/Getting-Data-In/Question-about-using-virtual-machines-for-intermediate/m-p/54092#M10460 hacktastic 2011-03-05T01:39:16Z https://community.splunk.com/t5/Getting-Data-In/Question-about-using-virtual-machines-for-intermediate/m-p/54093#M10461 <P>Yes, a VM for an intermediate forwarder should be fine, though you can probably use LWF just fine, as WMI shouldn't have any problems with buffered writes.</P> Sat, 05 Mar 2011 07:59:06 GMT https://community.splunk.com/t5/Getting-Data-In/Question-about-using-virtual-machines-for-intermediate/m-p/54093#M10461 gkanapathy 2011-03-05T07:59:06Z