Documentation > Splunk > Admin Manual > Configure round-robin data balancing

Admin Manual

 


Welcome
What to do first
Start Splunk
Meet Splunk Web and Splunk Apps
Before you configure
Add data and configure inputs
Indexing and event processing
Timestamps
Add and manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Set up forwarding and receiving
Deploy to other Splunk instances
Set up distributed search
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference
Troubleshooting

Configure round-robin data balancing

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Configure round-robin data balancing

This topic discusses configuration of round-robin data balancing, and assumes you have read the content in "About forwarding and receiving" and therefore know what a target group is.

Note: Splunk recommends using automatic load-balancing (auto-lb) instead of round-robin balancing if you can do so, because auto-lb offers a lot more flexibility in configuration and resiliency when a receiver or forwarder goes down.

A round robin configuration sends each individual event from a given forwarder to a different receiver specified in a target group of receivers. For example, if you have three receivers defined in your target group, a given forwarder will send one event to the first receiver, the next event to the second receiver, the next event to the third receiver, and then start over by sending the next event to the first receiver, then second, and so on, switching among the list of receivers in the target group. The events will be sent to the receivers in the order they are listed in the server= field in the target group.

Important: Round-robin data balancing does not work when forwarding from a Splunk Light Forwarder, because the events are not yet processed enough to know when one event ends and the next one begins when they leave the Light Forwarder.

To configure round-robin data balancing, edit outputs.conf on the forwarder to define a target group containing two or more receivers, like this: 

[tcpout:group1]
server=receiver1.fflanda.com:9997,10.1.1.197:6666

The previous configuration will cause the forwarder to send some events to receiver1.fflanda.com:9997 and some to 10.1.1.197:6666. As shown, you can use either host names or IP addresses. You must specify a port number.

If you specify multiple target groups (by adding more than one stanza), all the events from that forwarder will be sent (cloned) to each target group and divided among the receivers in that target group however you specify. For example, you could have one target group consisting of three receivers among which you round-robin data balance the events from this forwarder, and another target group containing a single receiver that receives all the events from this forwarder.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.0.6/Admin/Configureround-robindatabalancing"

This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!