I have a light forwarder sending data to my indexer. I'm bringing two new Splunk indexers online and want to use autoLB to send my data to these new indexers. However, I have a requirement that I need to continue sending to my original indexer.
Is it possible to do this?
Here's a sample configuration which tells Splunk to forward data to 2 groups. The first tcpout stanza is a standalone indexer. The 2nd tcpout stanza is a group of 2 servers:
outputs.conf:
[tcpout]
defaultGroup = indexer1, autoLB_Group
[tcpout:indexer1]
server = IP:<port>
[tcpout:autoLB_Group]
server = IP_autoLBserver1:<port>, IP_autoLBserver2:<port>
autoLB = true
autoLBFrequency = 30
Here's a sample configuration which tells Splunk to forward data to 2 groups. The first tcpout stanza is a standalone indexer. The 2nd tcpout stanza is a group of 2 servers:
outputs.conf:
[tcpout]
defaultGroup = indexer1, autoLB_Group
[tcpout:indexer1]
server = IP:<port>
[tcpout:autoLB_Group]
server = IP_autoLBserver1:<port>, IP_autoLBserver2:<port>
autoLB = true
autoLBFrequency = 30
http://answers.splunk.com/answers/77591/data-cloning-is-it-a-exact-clone.html
Need to add in inputs.conf on the forwarder, for the above example...
_TCP_ROUTING = indexer1, autoLB_Group
The _TCP_ROUTING would be needed if the outputs.conf "defaultGroup" were not configured to clone.
Optionally, both output groups can be autoLB groups, though obviously your usecase was the above.