Getting Data In

Considerations for adjusting autoLBFrequency in outputs.conf

dstaulcu
Builder

When using automatic load balancing of outputs from universal forwarders (UF), the default number of seconds a forwarder will stick with a server before redirecting outputs to another server in the pool (autoLBFrequency) is 30 seconds... I am tempted to increase the amount of time that a UF sticks to a server in order to reduce computation burden of session negotiation and to reduce the burden placed on DNS servers to resolve server names..

Does anyone have any experiences or thoughts on negative things that could possibly occur by increasing the period of time between server changes?

Inputs appreciated!

0 Karma

arizvi801
Explorer

I have played with this setting when load balancing 12,000+ devices. The caveat here is that I was doing this on a Windows 2012 machine. What eventually happened was that it took down my Server because of too many open connections. Other than that, just off the top of my head, depending on the load and if you are setup in a clustered environment, your hardware would also play a role in terms of indexing vs searching.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...