topic Re: Heavy Forwarder and Loadbalancing in Getting Data In

Heavy Forwarder and Loadbalancing

ivantn21 — Tue, 15 Jan 2013 14:17:25 GMT

Hello,

Here at my company we have one search head and three indexers.... We have a standalone server that has an Heavy Forwarder installed, we have a script on the server that is polling a database and sending the data to the forwarder through a TCP stream which gets indexed and forwarded to the indexers. The problem we are having is that the heavy forwarder is not properly distributing the data across the indexers and instead is sending everything to only one indexer... what should we do to solve this problem?

Re: Heavy Forwarder and Loadbalancing

jonuwz — Tue, 15 Jan 2013 15:37:31 GMT

How did you set up load balancing ? Does load balancing work for other sourcetypes forwarded by the heavy forwarder ?

Re: Heavy Forwarder and Loadbalancing

ivantn21 — Tue, 15 Jan 2013 15:51:39 GMT

I just edited the ouputs.conf to foward to three indexers and it does work for all sourcetypes it just don't load balance across the three indexers...

Re: Heavy Forwarder and Loadbalancing

mloven_splunk — Tue, 15 Jan 2013 15:54:59 GMT

ivantn21, can you post your outputs.conf?

Re: Heavy Forwarder and Loadbalancing

the_wolverine — Tue, 19 Mar 2013 19:04:13 GMT

What would be the expected behavior?

Re: Heavy Forwarder and Loadbalancing

jfraiberg — Mon, 15 Apr 2013 19:39:19 GMT

I believe that the problem is that it is a TCP stream. The autolb can't make the stream break. We see the same issue with routers sending data to a forwarder which load balances between 3 indexers. You will most likely notice that if you restart the splunk instance on the one indexer that is getting all the tcp stream data that it will change to the next one.