splunk AWS ALB sticky session

[raindrop18]

I have followed this doc http://docs.splunk.com/Documentation/AddOns/released/Firehose/ConfigureanALB
setup AWS ALB for Splunk HEC and the document suggest to enable Stickiness, however, didn't say the duration of the stickiness, anyone has any suggestion for the duration ?

thanks!

[jtacy]

I'm speculating a bit, but it sounds like stickiness is required because this service uses indexer acknowledgement and data duplication might result if the same client is bouncing between indexers all the time. To get the correct results, I think the timeout will need to be longer than any potential delay in indexing the data. The docs at http://dev.splunk.com/view/event-collector/SP-CAAAE8X suggest that data be resent if an acknowledgement isn't received in 5 minutes, so that might be a good starting point. The thing about stickiness is that you'll never hit the configured timeout if the same client is constantly connecting; in that case the timeout is effectively infinite. In any case, I probably wouldn't set it any higher than 5 minutes. Just my two cents!

[raindrop18]

thank you so much a great insight!!!

[hortonew]

How many indexers are you spraying data across? You want to spread data evenly across them without overloading one in a cluster. I haven't configured an ALB before, but if you have forwarders in your environment with autoLBFrequency configured (default 30s) in outputs.conf, I would mimic that as a place to start.

[raindrop18]

thanks for the response. I will check that.