Load Balacing

[ivantn21]

Would a heavy forwarder properly load balance a tcp stream input??

[paul_1994 · Accepted solution]

I am not sure what you are trying to say. A heavy forwarder would accept a TCP connection just fine. Can you give an example of your setup and what you are trying to load balance?

Are you asking if it would load balance the connection to the indexers?

[paul_1994]

I am not sure if you can try this but can you temporarily s stop the first indexer to see if the traffic will go there? Also are you seeing anything funny in the Splunkd log? From there if you still not seeing anything I would turn on debug for tcp input and then tail the Splunkd log.

I hope this helps.

[ivantn21]

So we have a script that dumps all table from a database to csv file and then we have the HF monitoring that folder where the files are being created, this setup works fine the HF will send data in a distributed fashion across all indexers... The other use case is that on the script we tried to use NetCat as soon as we got the result from a SELECT * FROM XTABLE to push the results directly to the HF without having to create files, but the HF would only forward the data to the first indexer on the outputs.conf...