topic Re: Is there a way to forward data collected using scripted inputs to multiple indexers using Splunk's load balancing feature? in Getting Data In

Is there a way to forward data collected using scripted inputs to multiple indexers using Splunk's load balancing feature?

sakti — Wed, 16 Nov 2016 19:54:47 GMT

Is there a way to forward data collected using [script] to multiple indexers using Splunk's load balancing feature? This is a TCP stream and am trying to implement this by using universal forwarder, and according to the documentation, it says:

Universal forwarders have a slight
disadvantage in that they can't switch
indexers when monitoring TCP network
streams of data unless they encounter
an End of File (EOF) marker in the
stream or an indexer goes down.

How and when could I introduce an EOF marker? Is there a setting in outputs.conf to do that or should my script handle this?

Re: Is there a way to forward data collected using scripted inputs to multiple indexers using Splunk's load balancing feature?

sakti — Wed, 16 Nov 2016 21:59:35 GMT

Adding to the question, if I report the data every n seconds does that get counted as marking the data stream with EOF for every n seconds?

Re: Is there a way to forward data collected using scripted inputs to multiple indexers using Splunk's load balancing feature?

gjanders — Wed, 16 Nov 2016 22:41:11 GMT

I'm wondering if event breaker enable will help here https://docs.splunk.com/Documentation/Forwarder/6.5.0/Forwarder/Configureloadbalancing from the documentation I'm not clear if it will help here...

If not, you might want to consider a syslogNG instance or similar to receive the TCP logs and then read the files through the universal forwarder, I have a post on that here

Re: Is there a way to forward data collected using scripted inputs to multiple indexers using Splunk's load balancing feature?

bernardoortega — Wed, 15 Feb 2017 09:09:59 GMT

Hello

You should use in outputs.,conf the following parameter:

forceTimebasedAutoLB=true

With this, it will load balance between indexers

regards