We want to ingest data from databases to our indexer .Would it be recommended to use heavy forwarder or UF ? Also can i load balanced the data between my indexer by making changes in output.conf? Recommendation please
You must use search heads and/or heavy forwarders: http://docs.splunk.com/Documentation/DBX/3.0.3/DeployDBX/Distributeddeployment
Forwarders can handle the load balancing without adding hardware: https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Forwarding/Setuploadbalancingd
