Getting Data In

Using F5 BIG IP to load balance in front of indexers

Path Finder

When load balancing among multiple indexers, would it work if F5 BIG IP is placed in front of the indexers to receive data from Universal Forwarders?

Tags (2)

Splunk Employee
Splunk Employee

Correct. Still preferred method is Splunk Forwarders.

Path Finder

Is this still the preferred configuration not to use Big-IPs? Are there future plans to provide the ability to use them between the indexers and UF?

Splunk Employee
Splunk Employee

If you are planning to use F5 BIG IP LTM to do for example Syslog load-balancing, then this is generally OK.

But if you are planning to do load balancing between Indexers and UF using a external load balancer, then this is not recommended and it is best left to the UF and Indexers to perform the load balancing by themselves. There are things like buffering or functions like UseAck which may break when a hardware load balancer is in the equation. So rather than complicating the setup, we would prefer the UF and Indexers to handle this by themselves.

Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...