Solved: Can we have fewer Heavy Forwarders than Indexers?

hrawat · ‎05-13-2021

hrawat · ‎05-13-2021

Current practice is to have more Heavy Forwarders than Indexers to keep all indexers busy. However starting 7.3.6 onwards you don't have to. Heavy forwarder can send data to multiple indexers in parallel per ingest pipeline.

All you have to set in outputs.conf (maxQueueSize = 5 * autoLBVolume)

Example
autoLBVolume = 5000000
maxQueueSize =25MB

View solution in original post

hrawat · ‎05-13-2021

Current practice is to have more Heavy Forwarders than Indexers to keep all indexers busy. However starting 7.3.6 onwards you don't have to. Heavy forwarder can send data to multiple indexers in parallel per ingest pipeline.

All you have to set in outputs.conf (maxQueueSize = 5 * autoLBVolume)

Example
autoLBVolume = 5000000
maxQueueSize =25MB

Can we have fewer Heavy Forwarders than Indexers?

heavy forwarder

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Observability Simplified: Combining User Experience, Application Performance & ...

Event Series May & June: From Network Visibility to Service Intelligence

Global Splunk User Group Events: May + June 2026

Join the Conversation