Getting Data In

Can a forwarder be configured to two indexers without load balancing?


I have tried quite unsuccessfully to search for an answer to achieve this configuration, so I'm asking here. Hopefully someone has a suggestion/solution to my kind of unusual configuration requirement.

Is it possible to configure a forwarder to send to two separate indexers without load balancing, so that both indexers receive all the data independently?

I understand this is an atypical situation, however, this is something I need to achieve. The indexers will be unable to communicate with each other and will be combined indexer/search heads, so they can't share the received data or be searched in a distributed fashion.

I would suppose it would be possible to run two forwarders on the monitored host(s) one forwarding out to each indexer, but this would be a I/O hog and wasteful of system resources. As a result it would be highly desirable to send to both indexers from a single instance of the forwarder on the monitored host.

Has anyone done this? Is it even possible?


1 Solution


WOW... Don't know how I missed THAT in the docs...


0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...