Does external load balancer works with Universal/Heavy forwarder?

hrawat — Fri, 27 Sep 2024 19:16:26 GMT

Related to recommendation as per following link

Setup load balancing

New versions of SPLUNK now fully support NLB. Splunkcloud is also behind NLB.
<on-prem fwd> ===>NLB===>splunk cloud

How to setup?
https://www.linkedin.com/posts/harendra-rawat-b10b41_asynchronous-forwarding-with-nlb-activity-7112204069363933185-SYRv/

Re: Does external load balancer works with Universal/Heavy forwarder?

hrawat — Thu, 22 Aug 2024 15:10:14 GMT

Note:
New versions of SPLUNK now fully support NLB. Splunkcloud is also behind NLB.
<on-prem fwd> ===>NLB===>splunk cloud

How to setup?
https://www.linkedin.com/posts/harendra-rawat-b10b41_asynchronous-forwarding-with-nlb-activity-71122...

Outputs.conf

External network load balancer will not work with UF/HF if DNS resolves only one IP-address for NLB. This limitation will be addressed in future releases.

Technically external network load balancer should work with UF/HF as long as DNS returns 2 or more IP addresses.. So why not recommended?

There are some scenarios where results will not be as expected.

Let’s say we have 100 k FWDs. Assuming NLB dns lookup will return 2 A records(NLB-IP1, NLB-IP2). Indexing tier with 25 indexers ( indexer1 - indexer25). Regardless of how NLB picks target indexer( volume or round robin or something else).

UF1 connects to NLB-IP1 and NLB connects to indexer1.
After autoLBFrequency(default 30 sec) UF1 will pick NLB-IP2. However It’s possible that NLB that is load balancing 100K FWD hosts, might connect to indexer1.
Over the period of time let’s say 1 hour, it’s possible that UF1 (out of 120 connections) might ended up connecting to one indexer ( or few indexers) more than rest.

With fewer number of A records for NLB, forwarder might stick to only one indexer.

topic Does external load balancer works with Universal/Heavy forwarder? in Getting Data In

Does external load balancer works with Universal/Heavy forwarder?

Re: Does external load balancer works with Universal/Heavy forwarder?