Getting Data In

Question about using virtual machines for intermediate forwarders

Path Finder

Hello folks,

I'm trying to puzzle out getting around SPL-34965 (WMI not load balancing), not inundating a single indexer (which is happening right now and screwing up my licensing) and keeping the the networking people happy by not asking for too many external IPs. I see that using an intermediate forwarder (HWF to avoid the done-key issue) is a solution. I completely understand why I wouldn't want to go virtual with the indexers and search head. But, can I get away with going virtual with intermediate forwarders? Does anyone have any anecdotal evidence?

We have about 725 LWFs sending to 3 indexers.

Thanks in advance.

0 Karma

Re: Question about using virtual machines for intermediate forwarders


Yes, a VM for an intermediate forwarder should be fine, though you can probably use LWF just fine, as WMI shouldn't have any problems with buffered writes.

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.