Using F5 BIG IP to load balance in front of indexers

[alextsui]

Hi,
When load balancing among multiple indexers, would it work if F5 BIG IP is placed in front of the indexers to receive data from Universal Forwarders?
Thanks.

[Dimitri_McKay]

Correct. Still preferred method is Splunk Forwarders.

[jonathon]

Is this still the preferred configuration not to use Big-IPs? Are there future plans to provide the ability to use them between the indexers and UF?

[twkan]

If you are planning to use F5 BIG IP LTM to do for example Syslog load-balancing, then this is generally OK.

But if you are planning to do load balancing between Indexers and UF using a external load balancer, then this is not recommended and it is best left to the UF and Indexers to perform the load balancing by themselves. There are things like buffering or functions like UseAck which may break when a hardware load balancer is in the equation. So rather than complicating the setup, we would prefer the UF and Indexers to handle this by themselves.