Load balanced URL/VIP for indexers

[mart10]

I have seen some information about load balancing within the outputs.conf file. And some regarding LB-side configuration (using nginx).

The scenario I have in mind, is where either:
a) All indexers are behing one address, say 'splunk-indexers', this as a round robin configuration, or alternatively 'least connections'
b) Each indexer is behind its own address, but it's still using LB/VIPs.

Are there a good amount of client/splunkforwarder-side options here? I am not sure how it usually balances between listed indexing servers.

I hope this isn't terribly explained..
The virtual IPs are pointing to either one or more indexing servers, depending on how we configure it.

[gcusello]

Hi @mart10,

you don't need of a VIP for indexers because Splunk has its own auloabalancing, why did you used a VIP?

Ciao.

Giuseppe

[mart10]

I do know I don't need it for Splunk, my question is rather if it can be done. When it comes to why, it's simply put that our network setup is complex and the only safe way to ensure non RFC-1918 collision is to use Public IPs.
So the question comes down to;
- Use public IPs on the entire setup?
- Or to use VIP to minimize the usage of public addresses down to a single address instead of X amounts?

[mart10 · Accepted solution]

To anyone finding this thread at a later time:
Public IPs was chosen.