Using Heavy Forwarder as a Relay

[dokaas_2]

I've seen the warnings of having UFs sending HFs and relaying to a index cluster. The objection seems to be around uneven distribution of events from the HFs to the indexers. However, doesn't setting the HFs outputs.conf variables: indexAndForward=false and autoLBFrequency=30 fix those issues?

Basically, have the UFs load balance to a pool of HFs and the pool of HFs load balance to the index cluster. If you do this, will you still have problems?

[isoutamo]

Hi
Here is one presentation about event distribution. https://www.slideshare.net/Splunk/best-practices-for-splunk-deployments
I think that this explain that.
r. Ismo