Getting Data In

setting forwarder with a priority list of indexers


If i have 2 Datacenter sites, each with its own single indexer.
Can I setup up my forwarders in site1 to forward to indexersite1 as default, but if indexersite1 goes down can it then forward to indexer_site2. And vice versa for splunk forwarders in site2.
Hope that makes sense, in other works I always want my forwarders to log to their local indexer unless that local indexer in in contactable.
I presume this is a config in outputs.conf, any help would be appreciated.
thanks, conor

Tags (3)
0 Karma


Hi conorglynn

other question: what will happen to the data from site1 on indexer_site2 if indexer_site1 is back online?

if you don't mind / care where the data is indexed, then setup load balancing all the time like in the docs written for setup load balancing



thanks for leading me in the right direction MuS,
I think this is the best solution to have it permanently load balanced.

0 Karma