Good question and I could see lot of variations/personal views on this setup. But please find my experience and some inputs
Option for Best performance and resilience => UF to Indexers. So if you have 120UF's out there, that means the system directly load balances the data into 6 indexers. that means each indexer get's 120::6 ratio of buckets each at a time assuming if it indexes just one file and splits the load evenly. When you search, the buckets are split and better for retrieving results
Option for more security. Though Lot of people go with above option, my view is it is NOT good to expose your indexer directly to client systems. Opinions may vary, but I would like to separate it with another layer like a Heavy forwarder layer or another UF layer.
Your setup of putting load balancer in front of Intermediate forwarders is NOT a good practice. It makes the whole splunk load balancing get wasted. The above is good ONLY if the load balancer is enabled for syslog data (and not from UF)
Compromise solution (option I'm leaning for) => Have an intermediate layer (UF or HF) and increase the number as much as possible with money allowance. Secure it and allow only specific ports and data collection only. Don't expose management ports. Assume you got 12 Intermediate forwarders. and if you have enough CPU/memory, enable multiple pipelines (say 2) which makes it similar to 24 Intermediate fwd. So assuming 120 clients sends to 24 Intermediate fwds which then sends to 6 indexers. So you still get a even split of 24::6 ratio. This way you can secure and load balance the data. This option also gives advantage of opening Firewall to Cloud services/Internet dataset without ever exposing Indexers
... View more