Has anyone successfully front ended deployment servers, receivers, or search heads with a load balancer?

[dstaulcu]

any gotchas, tips, tricks or advice with start of such projects?

[yannK · Accepted solution]

It depends :

• receivers, you probably means Indexers.
  You can use the splunk loadbalancing built in the forwarders, they will alternate between all the indexers they know.
  OR you can use a single dns record for all your indexers, and use a dns load balancer to point alternatively to a different indexer IPs.
  see http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Setuploadbalancingd

• search-head load balancing is the most delicate.
  It will require search-head pooling (you need the users profiles and search artifacts to be shared between all the search-heads)
  see http://docs.splunk.com/Documentation/Splunk/6.0/DistSearch/Usealoadbalancerwiththesearchheadpool

• deployment servers can be behind a dns load balancer.
  That way the clients will connect to one or another, but you will have to synchronize perfectly all your deployments server assets to avoid redeploying slightly different versions of the apps in loop. There are no documentation on those exotic setup. You may want to use a version control system to maintain your serverclass.conf and deployment-apps.
  (FYI the cascading is not mentioned in Splunk 6.* anymore because of the rewriting of the deployment server code)

[dstaulcu]

Thanks for the tip on DNS Round robin for deployment servers. That might be just the right level of effort for that role type. Next challenge is to figure out how to maintain SSL based communications through a layer 7 load balancer for the search heads.