Loadbalancer or intermediate forwarder?

[melonman]

Hi

I have many of universal forwarders that send (autoLB) events to multiple indexers in distributed search mode.
Now I am thinking to put 2 intermediate forwarders OR 2 load-balancers between universal forwarders and indexers.

Question:
Is it safe to use load-balancers between universal forwarders and indexers?
What is the best practice for this?

Thank you in advance..

[esix_splunk · Accepted solution]

While you can use a load balancer between the UF and Indexers, why? The UF's have load balancing functionality built in via the outputs. Unless you are trying to redirect traffic to different indexers from specific ip/host ranges. That would be the only benefit.

Intermediate Forwarders are in best practices. They'll buffer if indexers or connections are down, and allow parsing / routing offloads in case of loads on indexers.

[melonman]

Thank you!