All Apps and Add-ons

splunk AWS ALB sticky session

raindrop18
Communicator

I have followed this doc http://docs.splunk.com/Documentation/AddOns/released/Firehose/ConfigureanALB
setup AWS ALB for Splunk HEC and the document suggest to enable Stickiness, however, didn't say the duration of the stickiness, anyone has any suggestion for the duration ?

thanks!

Tags (1)
0 Karma

jtacy
Builder

I'm speculating a bit, but it sounds like stickiness is required because this service uses indexer acknowledgement and data duplication might result if the same client is bouncing between indexers all the time. To get the correct results, I think the timeout will need to be longer than any potential delay in indexing the data. The docs at http://dev.splunk.com/view/event-collector/SP-CAAAE8X suggest that data be resent if an acknowledgement isn't received in 5 minutes, so that might be a good starting point. The thing about stickiness is that you'll never hit the configured timeout if the same client is constantly connecting; in that case the timeout is effectively infinite. In any case, I probably wouldn't set it any higher than 5 minutes. Just my two cents!

0 Karma

raindrop18
Communicator

thank you so much a great insight!!!

0 Karma

hortonew
Builder

How many indexers are you spraying data across? You want to spread data evenly across them without overloading one in a cluster. I haven't configured an ALB before, but if you have forwarders in your environment with autoLBFrequency configured (default 30s) in outputs.conf, I would mimic that as a place to start.

0 Karma

raindrop18
Communicator

thanks for the response. I will check that.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...