Outputs.conf autoLB quesiton

[frankyip]

I have two indexers A and B.
UF always send data to A. If A is down, then UF send data to B. Is it possible to enforce so?

Thanks

[hunters_splunk]

Hi frankip,

Yes, you can configure autoLB in output.conf. Example:

[tcpout:splunk_indexer]
server = splunk1:9997,splunk2:9997,splunk3:9997
autoLB = true
forceTimebasedAutoLB = true
autoLBFrequency = 40

For details, please refer to this topic:
docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd

Hope it helps. Thank!
Hunter

[somesoni2]

This is not possible to achieve within Splulnk, using outputs.conf. You would need to use external DNS load balancer with HA design.