Best practice for load-balancing Splunk for SOURCEfire events

[edbolton]

What is the best practice for using this app in a load-balanced cluster? Is it possible to make an intermediate forwarder the eStreamer client and then load-balance the events over multiple indexers?

[edbolton · Accepted solution]

"Is it possible to make an intermediate forwarder the eStreamer client and then load-balance the events over multiple indexers?"

Yes.