Deployment Architecture

Auto Load Balancing Configuration Help...

balbano
Contributor

Hi guys,

For some reason looks like the Auto Load Balancing Config for my Light Forwarders is actually creating a copy of the same log on each indexer (2 indexers). I had assumed that autoLB would rotate logging from one server to the other every 30 seconds. Did I mis-configure my outputs.conf file somehow? Here is my outputs.conf file below:

outputs.conf file


[tcpout]
defaultGroup = indexer1, indexer2
disabled = false

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true

[tcpout-server://$indexer1_IP:9996]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = ******
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false

[tcpout-server://$indexer2_IP:9996]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = ******
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false

[tcpout:my_LB_indexers]
autoLB=true
server=$indexer1_IP:9996,$indexer2_IP:9996
compressed = true

[tcpout]
maxQueueSize = 1000


Any help you can provide would be great.

Thanks.

Brian

1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

It looks like this:

[tcpout]
defaultGroup = indexer1, indexer2

Should read:

[tcpout]
defaultGroup = my_LB_indexers

And you might remove this:

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

It looks like this:

[tcpout]
defaultGroup = indexer1, indexer2

Should read:

[tcpout]
defaultGroup = my_LB_indexers

And you might remove this:

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...