Is it possible to have multiple TCP output groups in outputs.conf and have events auto load balanced (autoLB) between them?

[sunnybrarjpmc]

Is it possible to have multiple tcp output groups in outputs.conf and have the events autoLB'd between them? My understanding is that autoLB only works within a given group and not multiple indexer groups.

[woodcock]

You are correct; autoLB only happens within a group. Everything goes to each group and within each group there is load-balancing. There is no functional difference, though. Why would you desire to abstract a simple configuration that way?

[kmorris_splunk]

Is it two different Splunk environments? Can you provide more information on what the reason for load balancing across two different groups would be?

[sunnybrarjpmc]

Yes, two different environments. We have an existing environment consisting of non-clustered indexers and a new group of clustered indexers that will be joining in. We'll be listing all clustered and non-clustered ones individually in outputs.conf but both sets use different certificates. We want the data to be spread (not duplicated) across both sets, and then we'll eventually stop the flow to the old ones.