outputs.conf in forwarder

[fuster_j]

If I've this in the outputs.conf in the fowarder:

[tcpout]

autoLB = true

autoLBFrequency = 10

compressed = false

defaultGroup = BBB

[tcpout:AAA]

server = aaa.abc.com:9997

[tcpout:BBB]

server = bbb.abc.com:9997,bbb2.abc.com:9997

[tcpout:CCC]

server = ccc.abc.com:9997

[tcpout-server://:9997]

Would I be sending same data 3 times which BBB get load balancing? Does that mean I'm burning 2 extra licenses?

[sdaniels]

I'm not completely clear from the above what you are trying to accomplish. You can set up a static list for auto load balancing. Your forwarder will split up the data between the three indexers. If one indexer is down it will just move on to the next one. It's sending the same data to all indexers and therefore using up more data volume.

[tcpout: BBB]
server=10.10.10.1:9997,10.10.10.2:9997,10.10.10.3:9997

[fuster_j]

Thank you for your input. The config above was setup before my time, just want to verify it's cloning data 3 times and all the servers should be in load balance method.