Deployment Architecture

Load Balacing

Explorer

Would a heavy forwarder properly load balance a tcp stream input??

Tags (1)
0 Karma
1 Solution

Path Finder

I am not sure what you are trying to say. A heavy forwarder would accept a TCP connection just fine. Can you give an example of your setup and what you are trying to load balance?

Are you asking if it would load balance the connection to the indexers?

View solution in original post

0 Karma

Path Finder

I am not sure what you are trying to say. A heavy forwarder would accept a TCP connection just fine. Can you give an example of your setup and what you are trying to load balance?

Are you asking if it would load balance the connection to the indexers?

View solution in original post

0 Karma

Path Finder

I am not sure if you can try this but can you temporarily s stop the first indexer to see if the traffic will go there? Also are you seeing anything funny in the Splunkd log? From there if you still not seeing anything I would turn on debug for tcp input and then tail the Splunkd log.

I hope this helps.

0 Karma

Explorer

So we have a script that dumps all table from a database to csv file and then we have the HF monitoring that folder where the files are being created, this setup works fine the HF will send data in a distributed fashion across all indexers... The other use case is that on the script we tried to use NetCat as soon as we got the result from a SELECT * FROM XTABLE to push the results directly to the HF without having to create files, but the HF would only forward the data to the first indexer on the outputs.conf...

0 Karma