Load Balancing Universal Forwarders

[jec013]

I am getting ready for a new install of Splunk. I am going to start with version 4.2. I would like to do a universal forwarder CLI install for the Windows servers we will be monitoring. We are going to be setting up load balancing for the indexers. Is there a way to specify multiple indexers during the CLI install? I have the following switch already configured:

RECEIVING_INDEXER="SplunkSvr01:9997"

Can I just add a comma and then SplunkSvr02:9997? I can't seem to find an answer anywhere in the documentation.

Thanks.

[jec013 · Accepted solution]

I figured out a way to accomplish this. I created an outputs.conf file that I copied over the one installed in %SPLUNK_HOME\etc\system\local. The new outputs.conf file had both indexers defined and load-balancing set to true. I then stopped and started the SplunkForwarder service. I checked both index servers that I was using for load-balancing and they were both receiving data successfully.

[gkanapathy]

Good question. In general, I prefer to install all forwarders as passive as possible, i.e, they do nothing and have no configuration except for the bare minimum necessary to update their own config from a centralized location, e.g. Splunk Deployment Server. That way, you don't have to worry about this and can easily update all your forwarders going forward.

This hasn't yet been updated for 4.2/Universal Forwarders (as for 2011-03-16), so the specific config file package is wrong, as are the MSI installer options, but the basic principle of sending out a passive forwarder with inputs disabled, no outputs, etc., is here:

http://www.splunk.com/wiki/Deploying_Splunk_Light_Forwarders