Auto Load Balancing Configuration Help...

[balbano]

Hi guys,

For some reason looks like the Auto Load Balancing Config for my Light Forwarders is actually creating a copy of the same log on each indexer (2 indexers). I had assumed that autoLB would rotate logging from one server to the other every 30 seconds. Did I mis-configure my outputs.conf file somehow? Here is my outputs.conf file below:

outputs.conf file

---

[tcpout]
defaultGroup = indexer1, indexer2
disabled = false

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true

[tcpout-server://$indexer1_IP:9996]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = ******
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false

[tcpout-server://$indexer2_IP:9996]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = ******
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false

[tcpout:my_LB_indexers]
autoLB=true
server=$indexer1_IP:9996,$indexer2_IP:9996
compressed = true

[tcpout]
maxQueueSize = 1000

---

Any help you can provide would be great.

Thanks.

Brian

[Ron_Naken · Accepted solution]

It looks like this:

[tcpout]
defaultGroup = indexer1, indexer2

Should read:

[tcpout]
defaultGroup = my_LB_indexers

And you might remove this:

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true