How does universal forwarder load balancing work?

[rongruspe]

Given this in outputs.conf:

[tcpout: my_LB_indexers]
server=10.10.10.1:9997,10.10.10.2:9996,10.10.10.3:9995

It states in the documentation that "The universal forwarder will load balance between the three receivers listed. If one receiver goes down, the forwarder automatically switches to another one on the list."

Question is, what if 10.10.10.1:9997 is always up, does that mean it wont send the data to the other two indexers? and only then will it change indexer, once 10.10.10.1:9997 is down? Or it distributes the data to all three indexers regardless if one is up/down?

[akanno · Accepted solution]

First , a universal forwarder send the data to 10.10.10.1:9997.
30 second later , a universal forwarder send the data to 10.10.10.2:9996.
30 second later , a universal forwarder send the data to 10.10.10.3:9995.
30 second later , a universal forwarder send the data to 10.10.10.1:9997.

In short , every 30 seconds, a universal forwarder will switch to another receiver.

for more information
http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Setuploadbalancingd

[rongruspe]

right on! thanks! can't believe i missed to read that part