How to calculate autoLB time interval?

[kteng2024]

Can i please know how to calculate the autoLB time interval as i am planning to change the default value. For example, a Universal Forwarder (UF) sends 15GB of data, so how much autoLB time interval should be?

[gjanders · Accepted solution]

This query might assist in providing a view of the distribution of events between your indexers:

| tstats summariesonly=t count WHERE index="*" by splunk_server _time | timechart span=10m sum(count) by splunk_server

I currently have the autoLBFrequency set to 12 seconds over 5 indexers it is evenly split over a minute. If you visualize the above as an area chart and make it stacked 100% you can see how even the load of data is over your indexers...

However the numbers will vary depending on your indexer/forwarder numbers. Furthermore this presentation on Splunk Worst Practices and How of Fix Them provides some potential options as well.

[woodcock]

What problem are you trying to solve? What is it that would motivate you to change the default? I have never considered changing the default and don't really see any reason that anybody would.

[esix_splunk]

This depends on how many indexers you have and the currently load on the indexers. Is there a reason you are changing the default? 30seconds typically is sufficient for most small deployments.