I am getting the message
Forwarding to indexer group default-autolb-group blocked for 100 seconds
I am running a single search head with two indexers and 42 Universal Forwarders. I have
[tcpout:default-autolb-group] configured in Splunk\etc\system\local\outputs.conf. on the search head with
server= pointing to the two indexers. My question is, do I need to have autoLB defined on the search head?
Hi scottrunyon, autoLB defaults to true, so it is already configured and there is no need to set it manually. Hope this helps!
autoLB = true
* Automatic load balancing is the only way to forward data. Round-robin method is not supported anymore.
* Defaults to true.
It looks to me that on the outputs.conf documentation, load balancing is defined for forwarders. My question concerns the search head, Is load balancing needed on a single search head with 2 indexers? In other words, can I remove the load balancing configuration and stop the message.