Getting Data In
Highlighted

Is it possible to have multiple TCP output groups in outputs.conf and have events auto load balanced (autoLB) between them?

New Member

Is it possible to have multiple tcp output groups in outputs.conf and have the events autoLB'd between them? My understanding is that autoLB only works within a given group and not multiple indexer groups.

0 Karma
Highlighted

Re: Is it possible to have multiple TCP output groups in outputs.conf and have events auto load balanced (autoLB) between them?

Splunk Employee
Splunk Employee

Is it two different Splunk environments? Can you provide more information on what the reason for load balancing across two different groups would be?

0 Karma
Highlighted

Re: Is it possible to have multiple TCP output groups in outputs.conf and have events auto load balanced (autoLB) between them?

New Member

Yes, two different environments. We have an existing environment consisting of non-clustered indexers and a new group of clustered indexers that will be joining in. We'll be listing all clustered and non-clustered ones individually in outputs.conf but both sets use different certificates. We want the data to be spread (not duplicated) across both sets, and then we'll eventually stop the flow to the old ones.

0 Karma
Highlighted

Re: Is it possible to have multiple TCP output groups in outputs.conf and have events auto load balanced (autoLB) between them?

Esteemed Legend

You are correct; autoLB only happens within a group. Everything goes to each group and within each group there is load-balancing. There is no functional difference, though. Why would you desire to abstract a simple configuration that way?

0 Karma