All Apps and Add-ons

splunk AWS ALB sticky session

raindrop18
Communicator

I have followed this doc http://docs.splunk.com/Documentation/AddOns/released/Firehose/ConfigureanALB
setup AWS ALB for Splunk HEC and the document suggest to enable Stickiness, however, didn't say the duration of the stickiness, anyone has any suggestion for the duration ?

thanks!

Tags (1)
0 Karma

jtacy
Builder

I'm speculating a bit, but it sounds like stickiness is required because this service uses indexer acknowledgement and data duplication might result if the same client is bouncing between indexers all the time. To get the correct results, I think the timeout will need to be longer than any potential delay in indexing the data. The docs at http://dev.splunk.com/view/event-collector/SP-CAAAE8X suggest that data be resent if an acknowledgement isn't received in 5 minutes, so that might be a good starting point. The thing about stickiness is that you'll never hit the configured timeout if the same client is constantly connecting; in that case the timeout is effectively infinite. In any case, I probably wouldn't set it any higher than 5 minutes. Just my two cents!

0 Karma

raindrop18
Communicator

thank you so much a great insight!!!

0 Karma

hortonew
Builder

How many indexers are you spraying data across? You want to spread data evenly across them without overloading one in a cluster. I haven't configured an ALB before, but if you have forwarders in your environment with autoLBFrequency configured (default 30s) in outputs.conf, I would mimic that as a place to start.

0 Karma

raindrop18
Communicator

thanks for the response. I will check that.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...