A company moves to a distributed architecture to meet the growing demand for the use of Splunk.
What parameter can be configured to enable automatic load balancing in the Universal Forwarder to send data to the indexers?

Question

A company moves to a distributed architecture to meet the growing demand for the use of Splunk.

What parameter can be configured to enable automatic load balancing in the Universal Forwarder to send data to the indexers?

Marcel Bertz · Accepted Answer

Set the stanza to have a server value equal to a comma-separated list of IP addresses and indexer ports for each of the indexers in the environment.

Marcel Bertz · Answer

Create one outputs . conf file for each of the server addresses in the indexing tier.

Marcel Bertz · Answer

Configure the outputs . conf file to point to any server in the indexing tier and Splunk will configure the data to be sent to all of the indexers.

Marcel Bertz · Answer

Splunk does not do load balancing and requires a hardware load balancer to balance traffic across the indexers.

List of questions