Outputs.conf autoLB quesiton

frankyip · ‎10-13-2016

I have two indexers A and B.
UF always send data to A. If A is down, then UF send data to B. Is it possible to enforce so?

Thanks

hunters_splunk · ‎10-13-2016

Hi frankip,

Yes, you can configure autoLB in output.conf. Example:

[tcpout:splunk_indexer]
server = splunk1:9997,splunk2:9997,splunk3:9997
autoLB = true
forceTimebasedAutoLB = true
autoLBFrequency = 40

For details, please refer to this topic:
docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd

Hope it helps. Thank!
Hunter

somesoni2 · ‎10-13-2016

This is not possible to achieve within Splulnk, using outputs.conf. You would need to use external DNS load balancer with HA design.