put splunk heavy forwarders behind loadbalancer

[raindrop18]

I have multiple heavy-forwarders and currently they are behind AWS route 53 DNS, and I am thinking if I get a benefit if I move the heavy forwarders behind loadbalancer. apperciate any feedback and if any related document about this highly appreciate it.

[somesoni2 · Accepted solution]

Splunk doesn't recommend setting up external load balance between forwarder (universal fwd in your case, I assume) and receiver (Intermediate Heavy fwd in your case, I assume). (see note on paragraph 1)

https://docs.splunk.com/Documentation/Forwarder/7.0.1/Forwarder/Configureloadbalancing

[raindrop18]

thanks very help full information.

[gwalford]

Why do you feel you would get a benefit from a load balancer? By default, the forwarders switch indexers every 30 seconds. This happens when the forwarder detects and End of File.

Load Balancing like this is the key to making distributed search or clustering work.

http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd

Now, you do want to do this for search heads, and syslog-ng data, but that is a different topic.

[raindrop18]

thanks for response. that answer my question!!