How to setup a load balancer for search heads.


How to setup a load balancer between search head and users ? I do have a VIP address with a stick protocol enabled on two ports.

Splunk Employee
Splunk Employee

Paraphrased from

One reason for using a load balancer in front of multiple search heads is to enable users to access one of any of the multiple search heads using a single point of access.

Using a load balancer will also ensure access to search artifacts and results if one of the search heads becomes inaccessible.

Keep in mind the following gotcha:

    The load balancer must employ layer-7 (application-level) processing. 

    Configure the load balancer so that user sessions are "sticky" or "persistent". 
    This ensures that the user remains on a single search head throughout their session. "

Edit 2016: You might be interested in checking out the benefits of Search Head Pooling as well:


2016 nobody should be using search head pooling in a new deployment. The new hotness (as of Splunk 6.2) is search head clustering.

Path Finder

You need to look into search head pooling

We ran into issues were we couldn't do this because our NFS mount wasn't fast enough. It needs to be pretty fast in order to perform well.

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...