Getting Data In

How does universal forwarder load balancing work?

rongruspe
New Member

Given this in outputs.conf:

[tcpout: my_LB_indexers]
server=10.10.10.1:9997,10.10.10.2:9996,10.10.10.3:9995

It states in the documentation that "The universal forwarder will load balance between the three receivers listed. If one receiver goes down, the forwarder automatically switches to another one on the list."

Question is, what if 10.10.10.1:9997 is always up, does that mean it wont send the data to the other two indexers? and only then will it change indexer, once 10.10.10.1:9997 is down? Or it distributes the data to all three indexers regardless if one is up/down?

0 Karma
1 Solution

akanno
Communicator

First , a universal forwarder send the data to 10.10.10.1:9997.
30 second later , a universal forwarder send the data to 10.10.10.2:9996.
30 second later , a universal forwarder send the data to 10.10.10.3:9995.
30 second later , a universal forwarder send the data to 10.10.10.1:9997.

In short , every 30 seconds, a universal forwarder will switch to another receiver.

for more information
http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Setuploadbalancingd

View solution in original post

akanno
Communicator

First , a universal forwarder send the data to 10.10.10.1:9997.
30 second later , a universal forwarder send the data to 10.10.10.2:9996.
30 second later , a universal forwarder send the data to 10.10.10.3:9995.
30 second later , a universal forwarder send the data to 10.10.10.1:9997.

In short , every 30 seconds, a universal forwarder will switch to another receiver.

for more information
http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Setuploadbalancingd

rongruspe
New Member

right on! thanks! can't believe i missed to read that part

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...