Data input for indexer cluster without univeral forwarder

[stwong]

Hi,

We're setting indexer clusters running Splunk 6.5.0. Some data sources are unable to install universal forwarder and thus direct data stream (tcp/udp/syslog) is used. Although there are multiple indexers, we only put one of the indexers in data source output configuration. I would like to know if there is any recommended method we can follow in order to avoid updating data source configuration when the indexer specified in the data source configuration file is down.
Sorry for the newbie question.

Thanks a lot.

[basanthp]

Create an external WIP/VIP around the set of indexers and specify this address in the data source configuration.

[stwong]

Seem this requires either hardware or software load balancers to do that. Any suggested tool for this purpose?

Thanks a lot.