topic How to configure load balancing on a heavy forwarder? in Getting Data In

How to configure load balancing on a heavy forwarder?

nce054 — Fri, 14 Aug 2015 14:42:00 GMT

I am configuring a Heavy Forwarder to point to 3 indexers. I want load balancing to be enabled. Are the individual tcpout-server stanzas interfering with the load balancing? Are they even necessary?

[tcpout]
disabled = false
defaultGroup = default-autolb-group
indexAndForward = 1
[tcpout-server://server1:9997]
[tcpout-server://server2:9997]
[tcpout-server://server3:9997]

[tcpout:default-autolb-group]
disabled = false
autoLB = true
autoLBFrequency = 7
server = server1:9997,server2:9997,server3:9997

Re: How to configure load balancing on a heavy forwarder?

s2_splunk — Fri, 14 Aug 2015 18:11:28 GMT

The tcpout-server stanzas are redundant, given that you have a routing group configured. What's the reason you set autoLBFrequency to just 7 seconds? There's going to be a lot of connection establishment/teardown going on. Just curious.

Re: How to configure load balancing on a heavy forwarder?

nce054 — Fri, 14 Aug 2015 18:16:02 GMT

I borrowed this setup from someone else, I did not understand what the attribute meant. What would be an advisable period?

Re: How to configure load balancing on a heavy forwarder?

s2_splunk — Fri, 14 Aug 2015 18:33:39 GMT

By default, the forwarders will switch to a different indexer (randomly) every 30 seconds, or when EOF is reached on a monitored file. There are situations where you want to tune that, specifically if you notice an uneven event distribution across your three indexers.
Having a good distribution of events across your indexing tier is ensuring optimal search performance.
Take a look here for more details on each of the outputs.conf settings.