I'm working on load balancing the universal forwarder and want to make sure the additional indexer that will now receive inputs from forwarders is configured to accept.
yes, I saw that. That's what I'm doing. The list of Forwarded data on the indexers is different. Don't see any mention of dealing with that anywhere so maybe it doesn't matter.
auto-load-balancing is configured at Universal Forwarder Level: Indexers must only be configured to receive logs (enable receiving on 9997 port).
Follow instructions at https://docs.splunk.com/Documentation/Forwarder/8.0.1/Forwarder/Configureloadbalancing :
defaultGroup = default-autolb-group
server = xx.xx.xx.xx:9997,yy.yy.yy.yy:9997
If you want, you can also configure autoLBFrequency and other parameters (see https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Outputsconf ).
in auto load balancing, half of data are in each Indexer, when you run a search on a Search Head conected with both the Indexers, you see all the data.
To have te same data on both the Indexers (HA), you have to configure an Indexer Cluster ( https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Clusterdeploymentoverview ).