Getting Data In

Question about using virtual machines for intermediate forwarders

hacktastic
Path Finder

Hello folks,

I'm trying to puzzle out getting around SPL-34965 (WMI not load balancing), not inundating a single indexer (which is happening right now and screwing up my licensing) and keeping the the networking people happy by not asking for too many external IPs. I see that using an intermediate forwarder (HWF to avoid the done-key issue) is a solution. I completely understand why I wouldn't want to go virtual with the indexers and search head. But, can I get away with going virtual with intermediate forwarders? Does anyone have any anecdotal evidence?

We have about 725 LWFs sending to 3 indexers.

Thanks in advance.

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes, a VM for an intermediate forwarder should be fine, though you can probably use LWF just fine, as WMI shouldn't have any problems with buffered writes.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Yes, a VM for an intermediate forwarder should be fine, though you can probably use LWF just fine, as WMI shouldn't have any problems with buffered writes.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...