Getting Data In
Highlighted

How to edit my outputs.conf to distribute data between different indexers?

Contributor

I have 3 indexers (A, B, C)

A and B are in one zone, C in another zone.

From my forwarders I want to load balance data to indexers A + B (50% data to A / 50% to B). I also want to send 100% of my data to indexer C. Essentially creating 2 copies of my data (1 split between A+B, 1 on C)

My outputs.conf currently accounts for A+B use case (below), how would I add in C to the stanza?

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server=A:9997,B:9997
0 Karma
Highlighted

Re: How to edit my outputs.conf to distribute data between different indexers?

Splunk Employee
Splunk Employee

Hello, that should do the cloning

[tcpout]
     defaultGroup = default-autolb-group,clone-group

 [tcpout:default-autolb-group]
    server=A:9997,B:9997

[tcpout:clone-group]
  server=C:9997

View solution in original post