Please explain the architecture a little bit more. Do you want to put an ELB in front of indexers or search heads? Splunk Cloud has internal load balancing.
On behalf of Frank,
He meant Splunk SH Cluster in AWS Cloud (EC2) instances.
We have 4 SH in cluster on EC2 instances
And Current config on ELB is to LB on port 443 in round-robin mechanism and Stickyness for stickysession is defined as 30s
Does that make sense ? need any additional information ?