configuring Universal forwarder for splunk cluster

[Somesh]

I have indexer cluster setup with a load-balancer in front of  it.  I want the syslog to be ingested into the indexer. My plan is to install Universal forwarder on the Linux servers and send the syslog to Indexer clusters. Now the problem is how can i configure universal forwarder to hit load-balancer to ingest the data ?

[PickleRick]

Ok, you're mixing several things here.

One thing is syslog - UFs don't send syslog. They can receive syslog (which is not advisable anyway to do directly on UF but that's a other story). They send data over so-called s2s protocol which might be embedded in http requests.

UFs have their own load-balancing mechanism and you should be using that. Network-level load balancing won't work properly.

If you expect your indexers set to change frequently you might use indexer discovery.

This is all you should discuss with your Splunk environment architect.

[gcusello]

Hi @Somesh ,

to send logs from Universal Forwarders to Indexers, you don't need to use a Load Balancer because Splunk has its own method to auto load balance data from UFs to IDXs.

You have only to indicate in outputs.conf (on UFs) the autoloadbalance group and the destination Indexers.

It's a different thing for syslogs: you need a Load Balancer to distribute load between receivers and manage fail over.

One thing, if possible don't use Indexers to receive syslogs, but use two (or more) UFs with an rsyslog (or syslog-ng) receiver, in this way you separate input phase by parsing, merging, tipying and indexing phases.

Ciao.

Giuseppe