Is it possible to configure cloning AND autoLB simultaneously?

[the_wolverine]

I have a light forwarder sending data to my indexer. I'm bringing two new Splunk indexers online and want to use autoLB to send my data to these new indexers. However, I have a requirement that I need to continue sending to my original indexer.

Is it possible to do this?

[the_wolverine · Accepted solution]

Here's a sample configuration which tells Splunk to forward data to 2 groups. The first tcpout stanza is a standalone indexer. The 2nd tcpout stanza is a group of 2 servers:

outputs.conf:

[tcpout]
defaultGroup = indexer1, autoLB_Group

[tcpout:indexer1]
server = IP:<port>

[tcpout:autoLB_Group]
server = IP_autoLBserver1:<port>, IP_autoLBserver2:<port>
autoLB = true
autoLBFrequency = 30

[ben_leung]

http://answers.splunk.com/answers/77591/data-cloning-is-it-a-exact-clone.html

Need to add in inputs.conf on the forwarder, for the above example...

_TCP_ROUTING = indexer1, autoLB_Group

[the_wolverine]

The _TCP_ROUTING would be needed if the outputs.conf "defaultGroup" were not configured to clone.

[jrodman]

Optionally, both output groups can be autoLB groups, though obviously your usecase was the above.