Question about using virtual machines for intermediate forwarders

[hacktastic]

Hello folks,

I'm trying to puzzle out getting around SPL-34965 (WMI not load balancing), not inundating a single indexer (which is happening right now and screwing up my licensing) and keeping the the networking people happy by not asking for too many external IPs. I see that using an intermediate forwarder (HWF to avoid the done-key issue) is a solution. I completely understand why I wouldn't want to go virtual with the indexers and search head. But, can I get away with going virtual with intermediate forwarders? Does anyone have any anecdotal evidence?

We have about 725 LWFs sending to 3 indexers.

Thanks in advance.

[gkanapathy · Accepted solution]

Yes, a VM for an intermediate forwarder should be fine, though you can probably use LWF just fine, as WMI shouldn't have any problems with buffered writes.