Getting Data In

Is it possible to configure cloning AND autoLB simultaneously?

the_wolverine
Champion

I have a light forwarder sending data to my indexer. I'm bringing two new Splunk indexers online and want to use autoLB to send my data to these new indexers. However, I have a requirement that I need to continue sending to my original indexer.

Is it possible to do this?

Tags (2)
0 Karma
1 Solution

the_wolverine
Champion

Here's a sample configuration which tells Splunk to forward data to 2 groups. The first tcpout stanza is a standalone indexer. The 2nd tcpout stanza is a group of 2 servers:

outputs.conf:

[tcpout]
defaultGroup = indexer1, autoLB_Group

[tcpout:indexer1]
server = IP:<port>

[tcpout:autoLB_Group]
server = IP_autoLBserver1:<port>, IP_autoLBserver2:<port>
autoLB = true
autoLBFrequency = 30

View solution in original post

the_wolverine
Champion

Here's a sample configuration which tells Splunk to forward data to 2 groups. The first tcpout stanza is a standalone indexer. The 2nd tcpout stanza is a group of 2 servers:

outputs.conf:

[tcpout]
defaultGroup = indexer1, autoLB_Group

[tcpout:indexer1]
server = IP:<port>

[tcpout:autoLB_Group]
server = IP_autoLBserver1:<port>, IP_autoLBserver2:<port>
autoLB = true
autoLBFrequency = 30

ben_leung
Builder

http://answers.splunk.com/answers/77591/data-cloning-is-it-a-exact-clone.html

Need to add in inputs.conf on the forwarder, for the above example...

_TCP_ROUTING = indexer1, autoLB_Group

0 Karma

the_wolverine
Champion

The _TCP_ROUTING would be needed if the outputs.conf "defaultGroup" were not configured to clone.

0 Karma

jrodman
Splunk Employee
Splunk Employee

Optionally, both output groups can be autoLB groups, though obviously your usecase was the above.

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...