topic Re: How does universal forwarder load balancing work? in Getting Data In

How does universal forwarder load balancing work?

rongruspe — Tue, 29 Sep 2015 03:39:58 GMT

Given this in outputs.conf:

[tcpout: my_LB_indexers]
server=10.10.10.1:9997,10.10.10.2:9996,10.10.10.3:9995

It states in the documentation that "The universal forwarder will load balance between the three receivers listed. If one receiver goes down, the forwarder automatically switches to another one on the list."

Question is, what if 10.10.10.1:9997 is always up, does that mean it wont send the data to the other two indexers? and only then will it change indexer, once 10.10.10.1:9997 is down? Or it distributes the data to all three indexers regardless if one is up/down?

Re: How does universal forwarder load balancing work?

akanno — Tue, 29 Sep 2015 04:57:16 GMT

First , a universal forwarder send the data to 10.10.10.1:9997.
30 second later , a universal forwarder send the data to 10.10.10.2:9996.
30 second later , a universal forwarder send the data to 10.10.10.3:9995.
30 second later , a universal forwarder send the data to 10.10.10.1:9997.

In short , every 30 seconds, a universal forwarder will switch to another receiver.

for more information
http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Setuploadbalancingd

Re: How does universal forwarder load balancing work?

rongruspe — Tue, 29 Sep 2015 05:00:49 GMT

right on! thanks! can't believe i missed to read that part