Getting Data In

Load balanced URL/VIP for indexers

mart10
Path Finder

I have seen some information about load balancing within the outputs.conf file. And some regarding LB-side configuration (using nginx).

The scenario I have in mind, is where either:
a) All indexers are behing one address, say 'splunk-indexers', this as a round robin configuration, or alternatively 'least connections'
b) Each indexer is behind its own address, but it's still using LB/VIPs.

Are there a good amount of client/splunkforwarder-side options here? I am not sure how it usually balances between listed indexing servers.

I hope this isn't terribly explained..
The virtual IPs are pointing to either one or more indexing servers, depending on how we configure it.

Labels (2)
0 Karma
1 Solution

mart10
Path Finder

To anyone finding this thread at a later time:
Public IPs was chosen.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mart10,

you don't need of a VIP for indexers because Splunk has its own auloabalancing, why did you used a VIP?

Ciao.

Giuseppe

0 Karma

mart10
Path Finder

I do know I don't need it for Splunk, my question is rather if it can be done. When it comes to why, it's simply put that our network setup is complex and the only safe way to ensure non RFC-1918 collision is to use Public IPs.
So the question comes down to;
- Use public IPs on the entire setup?
- Or to use VIP to minimize the usage of public addresses down to a single address instead of X amounts?

0 Karma

mart10
Path Finder

To anyone finding this thread at a later time:
Public IPs was chosen.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.