Archive

How does Splunk reconstruct events when using forceTimebasedAutoLB?

Champion

According to this blog post: http://blogs.splunk.com/2014/03/18/time-based-load-balancing/

Using this setting Splunk can break
the data stream and reconstruct the
event properly on the indexer.

That's pretty awesome. How exactly does this work when autoLB breaks the event and sends each segment to a different indexer? How do the indexers figure out where the other portion of the event is for reconstruction?

SplunkTrust
SplunkTrust

The forwarder sends 64KB chunks of data to the indexer (no matter the events on it). When its forced to send data to a second indexer, it resends the last 64KB chunk again to the second indexer. So:
1 - The first indexer it will index everything before the last event break and ignore the rest (to avoid indexing an incomplete event).
2 - The second indexer will index the data after the last event break which will be complete by the following 64KB chunks data.

This works ok if the events are smaller that 64KB.

------------
Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma

Champion

We're seeing broken events so I'm not sure if it's working as expected.

0 Karma

SplunkTrust
SplunkTrust

whats the size of your events? can you post a sample?

------------
Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma

Builder

I'm also interested in the behavior of this setting. Any update for us?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!