So I have recently installed Splunk independent stream forwarder as per the current [documentation][1]
This works great and I can use it to collect netflow data, however the default setup stream HEC setup sends the http event collector data to the indexers, however it appears to use some kind of persistent connection to *an* indexer.
For the last 24 hours it has sent *all* the data to 1 of the 6 indexers, while I'm not expecting a perfect load balancing algorithm at least switching between indexers once every X seconds (even if that means having multiple tcp connections kept open) would be preferable!
I can re-point the stream to localhost to let the local Splunk heavy forwarder receive it there, except that each time I restart the HF the system goes down for a couple of minutes.
I can also re-point the stream to a load balancer which talks to a forwarding layer before getting to the indexers but I'd like to know if there is a way to avoid this using just the independent stream forwarder...
[1]: https://docs.splunk.com/Documentation/StreamApp/latest/DeployStreamApp/InstallStreamForwarderonindependentmachine
↧
Splunk Independent Stream forwarder - Can we control the balance of data between indexers/receivers?
↧