topic Re: Load balanced URL/VIP for indexers in Getting Data In

Load balanced URL/VIP for indexers

mart10 — Wed, 28 Oct 2020 07:57:53 GMT

I have seen some information about load balancing within the outputs.conf file. And some regarding LB-side configuration (using nginx).

The scenario I have in mind, is where either:
a) All indexers are behing one address, say 'splunk-indexers', this as a round robin configuration, or alternatively 'least connections'
b) Each indexer is behind its own address, but it's still using LB/VIPs.

Are there a good amount of client/splunkforwarder-side options here? I am not sure how it usually balances between listed indexing servers.

I hope this isn't terribly explained..
The virtual IPs are pointing to either one or more indexing servers, depending on how we configure it.

Re: Load balanced URL/VIP for indexers

gcusello — Wed, 28 Oct 2020 08:09:02 GMT

Hi @mart10,

you don't need of a VIP for indexers because Splunk has its own auloabalancing, why did you used a VIP?

Ciao.

Giuseppe

Re: Load balanced URL/VIP for indexers

mart10 — Wed, 28 Oct 2020 09:01:01 GMT

I do know I don't need it for Splunk, my question is rather if it can be done. When it comes to why, it's simply put that our network setup is complex and the only safe way to ensure non RFC-1918 collision is to use Public IPs.
So the question comes down to;
- Use public IPs on the entire setup?
- Or to use VIP to minimize the usage of public addresses down to a single address instead of X amounts?

Re: Load balanced URL/VIP for indexers

mart10 — Thu, 29 Oct 2020 12:45:46 GMT

To anyone finding this thread at a later time:
Public IPs was chosen.