I am configuring a Heavy Forwarder to point to 3 indexers. I want load balancing to be enabled. Are the individual
tcpout-server stanzas interfering with the load balancing? Are they even necessary?
[tcpout] disabled = false defaultGroup = default-autolb-group indexAndForward = 1 [tcpout-server://server1:9997] [tcpout-server://server2:9997] [tcpout-server://server3:9997] [tcpout:default-autolb-group] disabled = false autoLB = true autoLBFrequency = 7 server = server1:9997,server2:9997,server3:9997
The tcpout-server stanzas are redundant, given that you have a routing group configured. What's the reason you set autoLBFrequency to just 7 seconds? There's going to be a lot of connection establishment/teardown going on. Just curious.
By default, the forwarders will switch to a different indexer (randomly) every 30 seconds, or when EOF is reached on a monitored file. There are situations where you want to tune that, specifically if you notice an uneven event distribution across your three indexers.
Having a good distribution of events across your indexing tier is ensuring optimal search performance.
Take a look here for more details on each of the outputs.conf settings.