Getting Data In
Highlighted

outputs.conf in forwarder

Path Finder

If I've this in the outputs.conf in the fowarder:

[tcpout]

autoLB = true

autoLBFrequency = 10

compressed = false

defaultGroup = BBB

[tcpout:AAA]

server = aaa.abc.com:9997

[tcpout:BBB]

server = bbb.abc.com:9997,bbb2.abc.com:9997

[tcpout:CCC]

server = ccc.abc.com:9997

[tcpout-server://:9997]

Would I be sending same data 3 times which BBB get load balancing? Does that mean I'm burning 2 extra licenses?

0 Karma
Highlighted

Re: outputs.conf in forwarder

Splunk Employee
Splunk Employee

I'm not completely clear from the above what you are trying to accomplish. You can set up a static list for auto load balancing. Your forwarder will split up the data between the three indexers. If one indexer is down it will just move on to the next one. It's sending the same data to all indexers and therefore using up more data volume.

[tcpout: BBB]
server=10.10.10.1:9997,10.10.10.2:9997,10.10.10.3:9997

0 Karma
Highlighted

Re: outputs.conf in forwarder

Path Finder

Thank you for your input. The config above was setup before my time, just want to verify it's cloning data 3 times and all the servers should be in load balance method.

0 Karma