Our Architectures has 3 universal forwarders running in cluster . There is a load balancer running in front of UF where all the source send logs via load balancer. Load balancer distributes data to any of the of the 3 UF's based on load.
We notice that that UF is not able to read all the sub directories.
That architecture sounds unusual. Please tell us more about it. What data is being sent to the UFs? Why is there a load balancer in front of the UFs?
Universal Forwarders usually read data from local files and send it to Splunk indexers. In that scenario, there is no place for a load balancer.
Perhaps your UFs are reading data from TCP ports and you are using the load balancer to distribute data among the UFs. But then the remark "not able to read all the sub directories" doesn't make sense to me.
Please tell us more about your problem.
--- If this reply helps you, an upvote would be appreciated.