Splunk Forwarder HA load balancing

[alexlee-mv]

I know that we could configure Auto-load balancing on multiple indexer.
But I want to use an active standby approach to license count on duplicated data.

In this case, could I configure the forwarder to route all the event an indexer primarily and route to another indexer when primarily indexer is not available.

[RubenOlsen]

The forwarders behavior "out of the box" is to forward data to whatever indexers that are available.

In you scenario your secondary indexer could be turned off by default (i.e. not running) - and with some script check if your primary indexer is not running. If the primary indexer is not running - then start the secondary indexer.

Seen from the forwarder point of view - this is a "no-brainer" as it will buffer any inputs if your primary indexer dies until it can deliver to your secondary indexer (and vice versa).

The problem with this approach might be if you need to search the data from your primary indexer if this becomes unavailable.

I have not tried this my self - but this should work.

Another approach is to deploy a network load-balancer in front of both indexers, and let this device send data to either your primary or your secondary indexer.