topic Re: Load balancing & failover between two heavy forwarders in Getting Data In

Load balancing & failover between two heavy forwarders

darshan_singh01 — Tue, 14 Jan 2014 07:47:17 GMT

Hi ,

My Splunk architecture is like this

I have two data centers (DC) and one each heavy forwarder in them .In each DC all the servers are forwarding the logs to heavy forwarder of the same DC via universal forwarders .
both the respective heavy forwarders are sending logs further to indexers .

Now I have the below query related to heavy forwarders ,load balancing .

In case of failure of heavy forwarder of one data center ,I want all my universal forwarders directly starts polling to the other heavy forwarder .
I am aware of that we can put the ip addresses of both the heavy forwarders in output.conf file of universal forwarder however how does it make sure that universal forwarder sends logs to the heavy forwarder of its own DC only in case of normal operation .Also how in case of failure of one Heavy forwarder it will send logs to the second heavy forwarder without making any config change ?

Re: Load balancing & failover between two heavy forwarders

bandit — Wed, 24 Sep 2014 15:29:10 GMT

My understanding is that this feature is not in Splunk (only automatic load balancing is available) and you would have to use something along the lines of a Load Balancer or 3DNS to assign a virtual host/ip with failover rules.

Hmm... wondering if it would work if you set autoLBFrequency to an extremely high number? i.e. 5 years in seconds 🙂

autoLBFrequency =

I don't see a maximum value stated in the outputs.conf documentation.
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf

Re: Load balancing & failover between two heavy forwarders

bandit — Wed, 24 Sep 2014 15:30:52 GMT

Splunk Dev, please add failover feature!

Re: Load balancing & failover between two heavy forwarders

vince2010091 — Fri, 17 Jul 2015 10:04:45 GMT

i'm voting for this feature too ! 🙂

Re: Load balancing & failover between two heavy forwarders

bseader — Tue, 01 Aug 2017 16:31:42 GMT

Please??
Me 2

Re: Load balancing & failover between two heavy forwarders

chaker — Wed, 02 Aug 2017 02:12:23 GMT

You could provision a new HF at each site an cluster them using
http://www.linux-ha.org/wiki/Main_Page

You could also use the Gemini Splunk Appliance which contains a HA feature that can be used at the HF tier.

Re: Load balancing & failover between two heavy forwarders

tejasode — Wed, 14 Aug 2024 11:18:24 GMT

Re: Load balancing & failover between two heavy forwarders

isoutamo — Wed, 14 Aug 2024 19:35:45 GMT

Currently you must create an idea for this to ideas.splunk.com if there haven’t been that already.