Deployment Architecture

configuring Universal forwarder for splunk cluster

Somesh
Explorer

I have indexer cluster setup with a load-balancer in front of  it.  I want the syslog to be ingested into the indexer. My plan is to install Universal forwarder on the Linux servers and send the syslog to Indexer clusters. Now the problem is how can i configure universal forwarder to hit load-balancer to ingest the data ?

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Ok, you're mixing several things here.

One thing is syslog - UFs don't send syslog. They can receive syslog (which is not advisable anyway to do directly on UF but that's a other story). They send data over so-called s2s protocol which might be embedded in http requests.

UFs have their own load-balancing mechanism and you should be using that. Network-level load balancing won't work properly.

If you expect your indexers set to change frequently you might use indexer discovery.

This is all you should discuss with your Splunk environment architect.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Somesh ,

to send logs from Universal Forwarders to Indexers, you don't need to use a Load Balancer because Splunk has its own method to auto load balance data from UFs to IDXs.

You have only to indicate in outputs.conf (on UFs) the autoloadbalance group and the destination Indexers.

It's a different thing for syslogs: you need a Load Balancer to distribute load between receivers and manage fail over.

One thing, if possible don't use Indexers to receive syslogs, but use two (or more) UFs with an rsyslog (or syslog-ng) receiver, in this way you separate input phase by parsing, merging, tipying and indexing phases.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...