Getting Data In

Load balanced URL/VIP for indexers

mart10
Path Finder

I have seen some information about load balancing within the outputs.conf file. And some regarding LB-side configuration (using nginx).

The scenario I have in mind, is where either:
a) All indexers are behing one address, say 'splunk-indexers', this as a round robin configuration, or alternatively 'least connections'
b) Each indexer is behind its own address, but it's still using LB/VIPs.

Are there a good amount of client/splunkforwarder-side options here? I am not sure how it usually balances between listed indexing servers.

I hope this isn't terribly explained..
The virtual IPs are pointing to either one or more indexing servers, depending on how we configure it.

Labels (2)
0 Karma
1 Solution

mart10
Path Finder

To anyone finding this thread at a later time:
Public IPs was chosen.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mart10,

you don't need of a VIP for indexers because Splunk has its own auloabalancing, why did you used a VIP?

Ciao.

Giuseppe

0 Karma

mart10
Path Finder

I do know I don't need it for Splunk, my question is rather if it can be done. When it comes to why, it's simply put that our network setup is complex and the only safe way to ensure non RFC-1918 collision is to use Public IPs.
So the question comes down to;
- Use public IPs on the entire setup?
- Or to use VIP to minimize the usage of public addresses down to a single address instead of X amounts?

0 Karma

mart10
Path Finder

To anyone finding this thread at a later time:
Public IPs was chosen.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...