Deployment Architecture

Auto Load Balancing Configuration Help...

balbano
Contributor

Hi guys,

For some reason looks like the Auto Load Balancing Config for my Light Forwarders is actually creating a copy of the same log on each indexer (2 indexers). I had assumed that autoLB would rotate logging from one server to the other every 30 seconds. Did I mis-configure my outputs.conf file somehow? Here is my outputs.conf file below:

outputs.conf file


[tcpout]
defaultGroup = indexer1, indexer2
disabled = false

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true

[tcpout-server://$indexer1_IP:9996]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = ******
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false

[tcpout-server://$indexer2_IP:9996]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = ******
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false

[tcpout:my_LB_indexers]
autoLB=true
server=$indexer1_IP:9996,$indexer2_IP:9996
compressed = true

[tcpout]
maxQueueSize = 1000


Any help you can provide would be great.

Thanks.

Brian

1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

It looks like this:

[tcpout]
defaultGroup = indexer1, indexer2

Should read:

[tcpout]
defaultGroup = my_LB_indexers

And you might remove this:

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

It looks like this:

[tcpout]
defaultGroup = indexer1, indexer2

Should read:

[tcpout]
defaultGroup = my_LB_indexers

And you might remove this:

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...