Can we have fewer Heavy Forwarders than Indexers?

[hrawat_splunk · Accepted solution]

Current practice is to have more Heavy Forwarders than Indexers to keep all indexers busy. However starting 7.3.6 onwards you don't have to. Heavy forwarder can send data to multiple indexers in parallel per ingest pipeline.

All you have to set in outputs.conf (maxQueueSize = 5 * autoLBVolume)

Example
autoLBVolume = 5000000
maxQueueSize =25MB