Hello everyone!
In this scenario i have one Heavy forwarder and one indexer cluster (of course the is a Cluster Manager over there).
The HF have some inputs configured in this way (inputs.conf):
[mi_input://List_Deployment_State]
index = endpoint sourcetype = endpoint _TCP_ROUTING = ixChabelaGroup
And the outputs were configured in this way (outputs.conf):
[tcpout] defaultGroup = ixChabelaGroup defaultGroup = default-autolb-group
[tcpout:ixChabelaGroup] server = 192.189.2.25:9997
As you can see the TCP_ROUTING is only sending data to one Indexer and we want to balance the data forwarding to the entire cluster.
My question is: what would it happen if i enable the indexer discovery in the Heavy Forwarder? as follows:
[tcpout:idxc-forwarders]
indexerDiscovery = cluster1
useACK=true
[indexer_discovery:cluster1]
master_uri = https://192.189.2.26:8089
pass4SymmKey = MyUnhashedPasswd
There will be a conflict between the indexer discovery and the _tcp_routing declared?
Or what is the proper way to configure the indexer discovery in my HF?
Thanks in advance for your support.
... View more