Hello!
Our setup consists of Universal Forwarders sending logs through a load balancer to Intermediate Forwarders then they end up in our indexers. The Intermediate forwarders send logs directly to the indexers, meaning, they have the indexers directly in their config.
I've read in a thread (https://answers.splunk.com/answers/230399/is-there-any-risk-in-load-balancing-universal-forw.html) thats there's a risk when using a load balancer between a Universal Forwarders and the indexers.
It's not our use case, but I was wondering is it a risk when using a loead balancer between Universal Forwarders and Intermediate forwarders?
Thanks a lot!
ciao
Alex
↧