I am using DNS lists for load balancing. I am pointing my forwarders to send data to my DNS, but I was wondering how can an indexer listen for data which is being forwarded to DNS?
I searched for document, but I could not find it, so can anyone please let me know how I can solve it?
Is it simply by enabling the listening port on my indexers?
or do I need any connection between my DNS and indexers?
thanks in advance
It may be possible that what you are looking for is the Splunk App for Stream. Stream uses the underlying packet capturing mechanisms on the various platforms to capture data off the wire and send it in via the Forwarder.
The topic is a bit lengthy to get into the solution here, I'd recommend reading and following the extensive documentation in the app and its areas themselves.
You need to setup Indexer to receive data onto a port (e.g. 9997). Then you need to configure your DNS LB to forward oncoming traffic to that port (9997) on the Indexers, So here is how it'll look like
To DNS LB Forward to Forwarders------------------> DNS LB --------------------> Indexers (receiving on 9997) on some port Indexers on say 9997 port 9997
i have followed the way u specified but i could not see any events in indexer.
on my forwarder i am getting a message as Forwarding to indexer group default-autolb-group blocked for 100 seconds.
here is my outputs.conf
defaultGroup = default-autolb-group
server = splunk-dns-test.XXXX:9997
and on my indexer i enabled listening
can you please help me
This is not recommended. This was being done at a previous company I consulted for and resulted in terrible performance, upon talking to a few at Splunk we discovered that the load balancers were breaking up the stream from the UF. It is much better to allow the SUFs to load balance for you - as they were designed.