I currently only have a single splunk server, but i would like to break it out to a distributed setup. I have been wondering how to setup the network devices to forward syslog to a load balanced IP, so i dont lose any data during reboots etc. The easiest quickest way for me is windows network load balance. Does anyone else have experience with a setup like this?
is there a way to forward to 2 splunk servers and have it figure out that it's duplicate data and store only once?
