Getting Data In

outputs.conf in forwarder

fuster_j
Path Finder

If I've this in the outputs.conf in the fowarder:

[tcpout]

autoLB = true

autoLBFrequency = 10

compressed = false

defaultGroup = BBB

[tcpout:AAA]

server = aaa.abc.com:9997

[tcpout:BBB]

server = bbb.abc.com:9997,bbb2.abc.com:9997

[tcpout:CCC]

server = ccc.abc.com:9997

[tcpout-server://:9997]

Would I be sending same data 3 times which BBB get load balancing? Does that mean I'm burning 2 extra licenses?

0 Karma

sdaniels
Splunk Employee
Splunk Employee

I'm not completely clear from the above what you are trying to accomplish. You can set up a static list for auto load balancing. Your forwarder will split up the data between the three indexers. If one indexer is down it will just move on to the next one. It's sending the same data to all indexers and therefore using up more data volume.

[tcpout: BBB]
server=10.10.10.1:9997,10.10.10.2:9997,10.10.10.3:9997

0 Karma

fuster_j
Path Finder

Thank you for your input. The config above was setup before my time, just want to verify it's cloning data 3 times and all the servers should be in load balance method.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...