https://community.splunk.com/t5/Getting-Data-In/What-are-the-available-load-balancing-method-in-Splunk/m-p/400651#M95129 <P>How to choose a load balancing method in Splunk? What are the available load balancing method in Splunk Forwarders?</P> Fri, 31 May 2019 07:23:09 GMT mbagali_splunk 2019-05-31T07:23:09Z https://community.splunk.com/t5/Getting-Data-In/What-are-the-available-load-balancing-method-in-Splunk/m-p/400651#M95129 <P>How to choose a load balancing method in Splunk? What are the available load balancing method in Splunk Forwarders?</P> Fri, 31 May 2019 07:23:09 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-the-available-load-balancing-method-in-Splunk/m-p/400651#M95129 mbagali_splunk 2019-05-31T07:23:09Z https://community.splunk.com/t5/Getting-Data-In/What-are-the-available-load-balancing-method-in-Splunk/m-p/400652#M95130 <P>There are two load balancing method in Splunk:</P> <UL> <LI><P>By time</P></LI> <LI><P>By Volume</P></LI> </UL> <P>By time. The default method for load balancing is how frequently the forwarders change indexers in the load balanced list. The autoLBFrequency setting in outputs.conf controls how often forwarders switch between indexers. The default frequency is every 30 seconds, but you can set it higher or lower.</P> <P>autoLBFrequency = <BR /> * The amount of time, in seconds, that a forwarder sends data to an indexer<BR /> before redirecting outputs to another indexer in the pool.<BR /> * Use this setting when you are using automatic load balancing of outputs<BR /><BR /> from universal forwarders (UFs).<BR /> * Every 'autoLBFrequency' seconds, a new indexer is selected randomly from the<BR /> list of indexers provided in the server setting of the target group<BR /> stanza.<BR /> * Default: 30<BR /> * List item<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Outputsconf">https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Outputsconf</A> </P> <P>By volume. Another option is to set how much data a forwarder sends to an indexer before it switches between indexers in a load-balanced list. The autoLBVolume setting in outputs.conf controls the amount of data that a forwarder sends to a receiving indexer before it changes to another one. By default, this setting is not active (0 bytes.) If you set it to anything other than 0, then the forwarder will change indexers based on the amount of data that it has sent.<BR /> autoLBVolume = <BR /> * The volume of data, in bytes, to send to an indexer before a new indexer <BR /> is randomly selected from the list of indexers provided in the server<BR /> setting of the target group stanza.<BR /> * This setting is closely related to the 'autoLBFrequency' setting. <BR /> The forwarder first uses 'autoLBVolume' to determine if it needs to switch to another indexer. If the 'autoLBVolume' is not reached,<BR /> but the 'autoLBFrequency' is, the forwarder switches to another indexer as the forwarding target.<BR /> * A non-zero value means that volume-based forwarding is active. <BR /> * 0 means the volume-based forwarding is not active.<BR /> * Default: 0<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Outputsconf">https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Outputsconf</A></P> <P>Please go through below documentation for more details:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Forwarding/Setuploadbalancingd">https://docs.splunk.com/Documentation/Splunk/7.2.6/Forwarding/Setuploadbalancingd</A></P> Fri, 31 May 2019 07:27:32 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-the-available-load-balancing-method-in-Splunk/m-p/400652#M95130 mbagali_splunk 2019-05-31T07:27:32Z