Load Balancing without the use of Forwarders

[Ant1D]

Hi,

I have set up a Splunk environment in which several applications will be sending data to a collection of indexers. I am considering using a traditional load balancer to manage the receiving of data by the indexers. Is this possible with a traditional load balancer or can I only do load balancing in Splunk via a Forwarder's load balancing capabilities?

Thanks in advance for your replies.

[bmacias84]

@Ant1D, The anwser is yes you can. To accomplish this you would use a modified version of Horizontal Scaling. Once you have configured you Traditional LB just configure your autoLBFrequency to the desireved value which will cause the forward to start a new stream on that interval.

Additional reading:

• Setuploadbalancingd

[tcpout]

defaultGroup=my_traditionalLB

[tcpout:my_traditionalLB]

disabled=false

autoLBFrequency=40

server=<IPorFQDN_of_LB>:9997

Hope this help or gets you started. Dont forget to vote or accept answers.

Cheers,

[Ant1D]

An example of a traditional load balancer here would be Cisco ACE

[Ant1D]

Hi I am basically saying that I do not want to use the load balancing functionality on Splunk Forwarders. I essentially want to know if someone has used an alternative to manage how data is sent to collection of forwarders

[barakreeves]

To better help you, could you please define what a "traditional load balancer" is? Then we should be able to help you out.