topic Load Balancing without the use of Forwarders in Getting Data In

Load Balancing without the use of Forwarders

Ant1D — Thu, 16 May 2013 15:32:28 GMT

Hi,

I have set up a Splunk environment in which several applications will be sending data to a collection of indexers. I am considering using a traditional load balancer to manage the receiving of data by the indexers. Is this possible with a traditional load balancer or can I only do load balancing in Splunk via a Forwarder's load balancing capabilities?

Thanks in advance for your replies.

Re: Load Balancing without the use of Forwarders

barakreeves — Thu, 16 May 2013 15:38:48 GMT

To better help you, could you please define what a "traditional load balancer" is? Then we should be able to help you out.

Re: Load Balancing without the use of Forwarders

Ant1D — Thu, 16 May 2013 15:47:44 GMT

Hi I am basically saying that I do not want to use the load balancing functionality on Splunk Forwarders. I essentially want to know if someone has used an alternative to manage how data is sent to collection of forwarders

Re: Load Balancing without the use of Forwarders

Ant1D — Thu, 16 May 2013 15:55:16 GMT

An example of a traditional load balancer here would be Cisco ACE

Re: Load Balancing without the use of Forwarders

bmacias84 — Thu, 16 May 2013 16:10:32 GMT

@Ant1D, The anwser is yes you can. To accomplish this you would use a modified version of Horizontal Scaling. Once you have configured you Traditional LB just configure your autoLBFrequency to the desireved value which will cause the forward to start a new stream on that interval.

Additional reading:

Setuploadbalancingd



[tcpout]

defaultGroup=my_traditionalLB

[tcpout:my_traditionalLB]

disabled=false

autoLBFrequency=40

server=<IPorFQDN_of_LB>:9997

Hope this help or gets you started. Dont forget to vote or accept answers.

Cheers,