Getting Data In

How to change forwarder configuration to load balance across the indexers

Explorer

We are planning to increasing Splunk indexers from 1 to 2. So, after this implementation, what are all the necessary changes we need to do at forwarder level.

0 Karma

SplunkTrust
SplunkTrust

Hi,

there are a couple of threads out there about this topic, even the splunk docs describe it here (forwarder load balancing) and here (indexer discovery).
You simply change your Universal/Heavy Forwarder's outputs.conf to one of those options.

Skalli

0 Karma