Getting Data In

Heavy Forwarder and Loadbalancing

ivantn21
Explorer

Hello,

Here at my company we have one search head and three indexers.... We have a standalone server that has an Heavy Forwarder installed, we have a script on the server that is polling a database and sending the data to the forwarder through a TCP stream which gets indexed and forwarded to the indexers. The problem we are having is that the heavy forwarder is not properly distributing the data across the indexers and instead is sending everything to only one indexer... what should we do to solve this problem?

Tags (1)

jfraiberg
Communicator

I believe that the problem is that it is a TCP stream. The autolb can't make the stream break. We see the same issue with routers sending data to a forwarder which load balances between 3 indexers. You will most likely notice that if you restart the splunk instance on the one indexer that is getting all the tcp stream data that it will change to the next one.

0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

ivantn21, can you post your outputs.conf?

0 Karma

the_wolverine
Champion

What would be the expected behavior?

0 Karma

ivantn21
Explorer

I just edited the ouputs.conf to foward to three indexers and it does work for all sourcetypes it just don't load balance across the three indexers...

0 Karma

jonuwz
Influencer

How did you set up load balancing ? Does load balancing work for other sourcetypes forwarded by the heavy forwarder ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...