How do I copy forwarder inputs from one indexer to another indexer?

[ntripp_element]

I'm working on load balancing the universal forwarder and want to make sure the additional indexer that will now receive inputs from forwarders is configured to accept.

[ntripp_element]

yes, I saw that. That's what I'm doing. The list of Forwarded data on the indexers is different. Don't see any mention of dealing with that anywhere so maybe it doesn't matter.

[gcusello]

Hi @ntripp_element,
auto-load-balancing is configured at Universal Forwarder Level: Indexers must only be configured to receive logs (enable receiving on 9997 port).

Follow instructions at https://docs.splunk.com/Documentation/Forwarder/8.0.1/Forwarder/Configureloadbalancing :
In outputs.conf:

[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://xx.xx.xx.xx:9997]
[tcpout-server://yy.yy.yy.yy:9997]

[tcpout:default-autolb-group]
server = xx.xx.xx.xx:9997,yy.yy.yy.yy:9997
disabled=false

If you want, you can also configure autoLBFrequency and other parameters (see https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Outputsconf ).

Ciao.
Giuseppe

[gcusello]

Hi @ntripp_element,
in auto load balancing, half of data are in each Indexer, when you run a search on a Search Head conected with both the Indexers, you see all the data.
To have te same data on both the Indexers (HA), you have to configure an Indexer Cluster ( https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Clusterdeploymentoverview ).

Ciao.
Giuseppe