Automatic Load Balancing

[Adpafer]

Hello,

I set up several hosts in Forwarding and Receiving section (different servers and ports) to forward logs. I can see there is Automatic Load Balancing option ENABLED. I want to have it DISABLED but do not know how to disable it.

Can anybody help me pls ?

thanks, pawel

[PickleRick]

The "Forwarding and Receiving" settings menu section is just a simplified version of specifying a default target group in outputs.conf. For a more complicated setup (like selectively forwarding events from single indexes or sets of indexes to specific receivers) you need to configure that in configs manually (it involves more than just defining outputs - it requires assigning proper metadata in props/transforms) - see the link provided by @gcusello .

[gcusello]

Hi @Adpafer,

what do you mean with disable Automatic AutoLoadBalancing and why do you want to do this?

Anyway, if you want to send logs from one UF to a specific Indcexer (there's no reason to do this!), you can use only that address in the outputs.conf of the UF.

if you want to perform a selective forwarding, see the configurations at https://docs.splunk.com/Documentation/Splunk/9.1.1/Forwarding/Routeandfilterdatad#Route_inputs_to_sp...

Ciao.

Giuseppe

[Adpafer]

Hi 🙂

Indexer can forward logs to other servers (forwarding and receiving)and I have to configure IP nad port of the host to which indexer can forward logs. I have two hosts visible in GUI (Forwarding and Receiving):

serverA:portA

serverB:portB

The problem is that I do not want to send all logs to these hosts. I want to send logs from IndexA to hostA  and logs from IndexB to hostB. Can I do it or I cannot ? If yes, how?

Thanks and regards, pawel

[gcusello]

Hi @Adpafer,

yes, you can, following the instructions on the above url.

Ciao.

Giuseppe