Getting Data In

outputs.conf in forwarder

fuster_j
Path Finder

If I've this in the outputs.conf in the fowarder:

[tcpout]

autoLB = true

autoLBFrequency = 10

compressed = false

defaultGroup = BBB

[tcpout:AAA]

server = aaa.abc.com:9997

[tcpout:BBB]

server = bbb.abc.com:9997,bbb2.abc.com:9997

[tcpout:CCC]

server = ccc.abc.com:9997

[tcpout-server://:9997]

Would I be sending same data 3 times which BBB get load balancing? Does that mean I'm burning 2 extra licenses?

0 Karma

sdaniels
Splunk Employee
Splunk Employee

I'm not completely clear from the above what you are trying to accomplish. You can set up a static list for auto load balancing. Your forwarder will split up the data between the three indexers. If one indexer is down it will just move on to the next one. It's sending the same data to all indexers and therefore using up more data volume.

[tcpout: BBB]
server=10.10.10.1:9997,10.10.10.2:9997,10.10.10.3:9997

0 Karma

fuster_j
Path Finder

Thank you for your input. The config above was setup before my time, just want to verify it's cloning data 3 times and all the servers should be in load balance method.

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...