Is there a way to forward data collected using scripted inputs to multiple indexers using Splunk's load balancing feature?

[sakti]

Is there a way to forward data collected using [script] to multiple indexers using Splunk's load balancing feature? This is a TCP stream and am trying to implement this by using universal forwarder, and according to the documentation, it says:

Universal forwarders have a slight
disadvantage in that they can't switch
indexers when monitoring TCP network
streams of data unless they encounter
an End of File (EOF) marker in the
stream or an indexer goes down.

How and when could I introduce an EOF marker? Is there a setting in outputs.conf to do that or should my script handle this?

[bernardoortega]

Hello

You should use in outputs.,conf the following parameter:

forceTimebasedAutoLB=true

With this, it will load balance between indexers

regards

[gjanders]

I'm wondering if event breaker enable will help here https://docs.splunk.com/Documentation/Forwarder/6.5.0/Forwarder/Configureloadbalancing from the documentation I'm not clear if it will help here...

If not, you might want to consider a syslogNG instance or similar to receive the TCP logs and then read the files through the universal forwarder, I have a post on that here

[sakti]

Adding to the question, if I report the data every n seconds does that get counted as marking the data stream with EOF for every n seconds?