Splunk Forwarder preferred path

[djluke]

Hi Splunkers,
does anyone have an idea how to configure a preferred path on a Splunk Forwarder?
I have 2 datacenters with many UF sending data in balanced mode to local indexers.
I would like to configure UF to automatically send data to indexers in the other DC only in case local ones are unavailable (maintenance / crash / ...)

Capture.PNG

Thanks in advance
Any suggestion will be very appreciated

[PickleRick · Accepted solution]

UF's loadbalanced group is served as a whole. So you could try to set the load-balancing limits to make the UF never switch to another output but you never know which one will be tried first. Also after switching to the other one in case of emergency, the UF would never fall back to the "primary site".

With a sufficiently recent forwarder you could use httpout and external LB (like haproxy) with properly configured backend policy.

[djluke]

Thanks for quick answer.
I was hoping we could handle it directly via Splunk configuration. Would it be the same even if I have a Heavy forwarder instead of UF?

[PickleRick]

I think so. While you could dynamically set TCP_ROUTE, I don't think you can get output channel state from within a transform.