Can i please know how to calculate the autoLB time interval as i am planning to change the default value. For example, a Universal Forwarder (UF) sends 15GB of data, so how much autoLB time interval should be?
This query might assist in providing a view of the distribution of events between your indexers:
| tstats summariesonly=t count WHERE index="*" by splunk_server _time | timechart span=10m sum(count) by splunk_server
I currently have the autoLBFrequency set to 12 seconds over 5 indexers it is evenly split over a minute. If you visualize the above as an area chart and make it stacked 100% you can see how even the load of data is over your indexers...
However the numbers will vary depending on your indexer/forwarder numbers. Furthermore this presentation on Splunk Worst Practices and How of Fix Them provides some potential options as well.
This query might assist in providing a view of the distribution of events between your indexers:
| tstats summariesonly=t count WHERE index="*" by splunk_server _time | timechart span=10m sum(count) by splunk_server
I currently have the autoLBFrequency set to 12 seconds over 5 indexers it is evenly split over a minute. If you visualize the above as an area chart and make it stacked 100% you can see how even the load of data is over your indexers...
However the numbers will vary depending on your indexer/forwarder numbers. Furthermore this presentation on Splunk Worst Practices and How of Fix Them provides some potential options as well.
What problem are you trying to solve? What is it that would motivate you to change the default? I have never considered changing the default and don't really see any reason that anybody would.
This depends on how many indexers you have and the currently load on the indexers. Is there a reason you are changing the default? 30seconds typically is sufficient for most small deployments.