Getting Data In

Load balanced URL/VIP for indexers

mart10
Path Finder

I have seen some information about load balancing within the outputs.conf file. And some regarding LB-side configuration (using nginx).

The scenario I have in mind, is where either:
a) All indexers are behing one address, say 'splunk-indexers', this as a round robin configuration, or alternatively 'least connections'
b) Each indexer is behind its own address, but it's still using LB/VIPs.

Are there a good amount of client/splunkforwarder-side options here? I am not sure how it usually balances between listed indexing servers.

I hope this isn't terribly explained..
The virtual IPs are pointing to either one or more indexing servers, depending on how we configure it.

Labels (2)
0 Karma
1 Solution

mart10
Path Finder

To anyone finding this thread at a later time:
Public IPs was chosen.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mart10,

you don't need of a VIP for indexers because Splunk has its own auloabalancing, why did you used a VIP?

Ciao.

Giuseppe

0 Karma

mart10
Path Finder

I do know I don't need it for Splunk, my question is rather if it can be done. When it comes to why, it's simply put that our network setup is complex and the only safe way to ensure non RFC-1918 collision is to use Public IPs.
So the question comes down to;
- Use public IPs on the entire setup?
- Or to use VIP to minimize the usage of public addresses down to a single address instead of X amounts?

0 Karma

mart10
Path Finder

To anyone finding this thread at a later time:
Public IPs was chosen.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...