According to this blog post: http://blogs.splunk.com/2014/03/18/time-based-load-balancing/> Using this setting Splunk can break> the data stream and reconstruct the> event properly on the indexer.
That's pretty awesome. How exactly does this work when autoLB breaks the event and sends each segment to a different indexer? How do the indexers figure out where the other portion of the event is for reconstruction?
↧