Getting Data In

Is it possible to have multiple TCP output groups in outputs.conf and have events auto load balanced (autoLB) between them?

sunnybrarjpmc
New Member

Is it possible to have multiple tcp output groups in outputs.conf and have the events autoLB'd between them? My understanding is that autoLB only works within a given group and not multiple indexer groups.

0 Karma

woodcock
Esteemed Legend

You are correct; autoLB only happens within a group. Everything goes to each group and within each group there is load-balancing. There is no functional difference, though. Why would you desire to abstract a simple configuration that way?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Is it two different Splunk environments? Can you provide more information on what the reason for load balancing across two different groups would be?

0 Karma

sunnybrarjpmc
New Member

Yes, two different environments. We have an existing environment consisting of non-clustered indexers and a new group of clustered indexers that will be joining in. We'll be listing all clustered and non-clustered ones individually in outputs.conf but both sets use different certificates. We want the data to be spread (not duplicated) across both sets, and then we'll eventually stop the flow to the old ones.

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...