SplunkForwarder Loadbalancing

[hojinpk]

Hello,

I'd like to send syslog data to other syslog server via SplunkForwarder. So I configured in outputs.conf of the SplunkForwarder as below. However the packets are sending to 10.10.10.1 only. With this configuration, 10.10.10.2 server is not received syslog when syslog is sending to 10.10.10.1 server of course. But I can't see any incoming syslog on 10.10.10.2 even if I wait for a long time, about 1~2 hours.

[syslog:our_syslog]
disabled = false
autoLB = true
autoLBFrequency = 40
server = 10.10.10.1:514, 10.10.10.2:514
type = udp

P.S.) I confirmed that the UDP packet can be sent from SplunkForwarder server to 10.10.10.2 with Linux command: $ echo –n “hello” >/dev/udp/10.10.10.2/514

Could you give me any clue for resolve the issue?
Thank you in advance.

[asimagu]

ok, well, I take that you installed a full Splunk instance and that you want it to forward data with the SplunkForwader app. Therefore your instance will become a Heavyweight Forwarder (HWF)

Basically you need to enable the forwarding app and then configure outputs.conf and inputs.conf but inside the SplunkForwarder app: /opt/splunk/etc/apps/SplunkForwarder/local/

To enable the app:
splunk enable app SplunkForwarder -auth :

More info here: http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/Deployaheavyforwarder

If your instance was only a Universal Forwarder, then you can check out this doc
http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/Deployanixdfmanually

[asimagu]

what steps did you follow? did you enable the forwarding app or did you change it under /system/local ? did you restart splunk after the config changes?

[hojinpk]

First of all thank you for your reply.
-. I configured it on /opt/splunk/etc/system/local/inputs.conf
-. And then I restarted Splunk. /opt/splunk/bin/splunk restart

However, I didn't enable the forwarding app. I just set to Forwarder license group and I configured inputs.conf, props.conf, transforms.conf and outputs.conf to forward received data to the others. Could you let me know how can I enable the forwarding app?