Getting Data In

How do I copy forwarder inputs from one indexer to another indexer?

ntripp_element
Explorer

I'm working on load balancing the universal forwarder and want to make sure the additional indexer that will now receive inputs from forwarders is configured to accept.

0 Karma

ntripp_element
Explorer

yes, I saw that. That's what I'm doing. The list of Forwarded data on the indexers is different. Don't see any mention of dealing with that anywhere so maybe it doesn't matter.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ntripp_element,
auto-load-balancing is configured at Universal Forwarder Level: Indexers must only be configured to receive logs (enable receiving on 9997 port).

Follow instructions at https://docs.splunk.com/Documentation/Forwarder/8.0.1/Forwarder/Configureloadbalancing :
In outputs.conf:

[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://xx.xx.xx.xx:9997]
[tcpout-server://yy.yy.yy.yy:9997]

[tcpout:default-autolb-group]
server = xx.xx.xx.xx:9997,yy.yy.yy.yy:9997
disabled=false

If you want, you can also configure autoLBFrequency and other parameters (see https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Outputsconf ).

Ciao.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ntripp_element,
in auto load balancing, half of data are in each Indexer, when you run a search on a Search Head conected with both the Indexers, you see all the data.
To have te same data on both the Indexers (HA), you have to configure an Indexer Cluster ( https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Clusterdeploymentoverview ).

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...