Getting Data In

Is it possible to configure cloning AND autoLB simultaneously?

the_wolverine
Champion

I have a light forwarder sending data to my indexer. I'm bringing two new Splunk indexers online and want to use autoLB to send my data to these new indexers. However, I have a requirement that I need to continue sending to my original indexer.

Is it possible to do this?

Tags (2)
0 Karma
1 Solution

the_wolverine
Champion

Here's a sample configuration which tells Splunk to forward data to 2 groups. The first tcpout stanza is a standalone indexer. The 2nd tcpout stanza is a group of 2 servers:

outputs.conf:

[tcpout]
defaultGroup = indexer1, autoLB_Group

[tcpout:indexer1]
server = IP:<port>

[tcpout:autoLB_Group]
server = IP_autoLBserver1:<port>, IP_autoLBserver2:<port>
autoLB = true
autoLBFrequency = 30

View solution in original post

the_wolverine
Champion

Here's a sample configuration which tells Splunk to forward data to 2 groups. The first tcpout stanza is a standalone indexer. The 2nd tcpout stanza is a group of 2 servers:

outputs.conf:

[tcpout]
defaultGroup = indexer1, autoLB_Group

[tcpout:indexer1]
server = IP:<port>

[tcpout:autoLB_Group]
server = IP_autoLBserver1:<port>, IP_autoLBserver2:<port>
autoLB = true
autoLBFrequency = 30

ben_leung
Builder

http://answers.splunk.com/answers/77591/data-cloning-is-it-a-exact-clone.html

Need to add in inputs.conf on the forwarder, for the above example...

_TCP_ROUTING = indexer1, autoLB_Group

0 Karma

the_wolverine
Champion

The _TCP_ROUTING would be needed if the outputs.conf "defaultGroup" were not configured to clone.

0 Karma

jrodman
Splunk Employee
Splunk Employee

Optionally, both output groups can be autoLB groups, though obviously your usecase was the above.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...