topic Re: Automatic Load Balancing in Getting Data In

Automatic Load Balancing

Adpafer — Wed, 06 Sep 2023 16:24:48 GMT

Hello,

I set up several hosts in Forwarding and Receiving section (different servers and ports) to forward logs. I can see there is Automatic Load Balancing option ENABLED. I want to have it DISABLED but do not know how to disable it.

Can anybody help me pls ?

thanks, pawel

Re: Automatic Load Balancing

gcusello — Thu, 07 Sep 2023 06:49:38 GMT

Hi @Adpafer,

what do you mean with disable Automatic AutoLoadBalancing and why do you want to do this?

Anyway, if you want to send logs from one UF to a specific Indcexer (there's no reason to do this!), you can use only that address in the outputs.conf of the UF.

if you want to perform a selective forwarding, see the configurations at https://docs.splunk.com/Documentation/Splunk/9.1.1/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input

Ciao.

Giuseppe

Re: Automatic Load Balancing

Adpafer — Thu, 07 Sep 2023 08:40:33 GMT

Hi 🙂

Indexer can forward logs to other servers (forwarding and receiving)and I have to configure IP nad port of the host to which indexer can forward logs. I have two hosts visible in GUI (Forwarding and Receiving):

serverA:portA

serverB:portB

The problem is that I do not want to send all logs to these hosts. I want to send logs from IndexA to hostA and logs from IndexB to hostB. Can I do it or I cannot ? If yes, how?

Thanks and regards, pawel

Re: Automatic Load Balancing

gcusello — Thu, 07 Sep 2023 08:53:28 GMT

Hi @Adpafer,

yes, you can, following the instructions on the above url.

Ciao.

Giuseppe

Re: Automatic Load Balancing

PickleRick — Thu, 07 Sep 2023 08:54:05 GMT

The "Forwarding and Receiving" settings menu section is just a simplified version of specifying a default target group in outputs.conf. For a more complicated setup (like selectively forwarding events from single indexes or sets of indexes to specific receivers) you need to configure that in configs manually (it involves more than just defining outputs - it requires assigning proper metadata in props/transforms) - see the link provided by @gcusello .