We are setting up splunk in AWS and we currently have a cluster with 1 Master, 3 indexers, 1 deployer, 3 searchheads(includes 1 captain).
We do not use any forwarders and so enabled HEC in indexers. Now we are trying to setup a load balancer in front of indexers to send the data to be indexed.
Do we have any recommended way to configure this ELB of rindexers with HEC and no forwarders in AWS?
Below are few more questions I have
Which kind of LB is appropriate for this usecase - ALB or NLB. I think ALB is the correct one as it supports HTTP and HTTPS
How can we do the health checks - How can I configure ELB to have health checks for both the scenarios of 1. Indexer node going down and 2. Splunk/HEC going down in the indexer - in which case, the ELB should not route traffic to this node. Do I need to setup the ELB target as a lambda function to achieve this goal?
If you are using indexer discovery, as you should be with an indexer cluster and master, there is not really any benefit to load balancing the indexers. The master will handle that for you. There are two methods, time based and volume based. The prior is likely best (every 30 seconds, etc. as opposed to every 10mb e.g.).
Enabling HEC on indexers directly is not good practice, imvho. Those should be dedicated nodes.