Forwarding data to dynamic IPs

[av_]

I am trying to forward data from UF to few indexers but the indexes have dynamic IPs which keep changing. Now, how does the UF know where to forward the data
How can I tackle this problem?

Also, can someone explain what is a smartstore & how does it work?

[hrawat]

If there is a NLB in between UF/HF and indexing tier, you don't have to worry as DNS should return static IPs for NLB.
If there is no NLB in between UF/HF and indexing tier and you are banking on DNS to return dynamic IPs and your possible outputs.conf config is

server=<DNS alias for dynamic idx IPs>:<splunktcp port>

you must reduce dnsResolutionInterval in outputs.conf as low as possible. It will decide how fast new dynamic IPs picked by UF/HF.

[deepakc]

I've never come across an Splunk environment that uses dynamic IP's for indexers (might be asking for trouble) , but there may be some use cases, I don't know, probably cloud environments. Normally one would use static IP's and DNS service and name's for UF to Indexers communications. You would then configure your outputs.conf with those DNS names. The UF's have inbuilt functionality to spray portions of the data across the Indexers. So DNS may be the way forward for you. 

Example outputs.conf 

[tcpout]
defaultGroup = my_indexers

[tcpout:my_indexers]
server = indexer1.example.com:9997, indexer2.example.com:9997 

If using Indexer cluster, you can use the Cluster Master Discovery Option - Read all about it here. 

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/indexerdiscovery 

Regarding Smart Store - Read all about it here. 

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/AboutSmartStore