load balancing

noun

The activity by which a forwarder distributes its data stream across multiple receiving Splunk indexers in a predefined group. For instance, if a load-balanced group of three receiving indexers has been defined, the forwarder will send data to each one sequentially. It sends data first to indexer "A", then it switches to indexer "B", then to indexer "C", then back to indexer "A", indexer "B", and so on. Each indexer receives a slice of the data. Together, the load-balanced group holds the full data stream.

Load balancing has several key uses. In particular, it enables horizontal scaling for improved performance. It also ensures resiliency in the face of machine outages. If an indexer goes down, the forwarder immediately begins sending data to the next available indexer in the load-balancing group. In combination with cloning, load balancing helps promote data availability.

There are two types of load balancing: automatic and round-robin. In automatic load balancing, the forwarder uses a specified time interval to determine when to begin sending data to the next receiving indexer. In round-robin load balancing, the forwarder switches to a new receiver with each new event. In nearly all cases, automatic load balancing is a better solution.

Important: Starting with release 4.2, round-robin load balancing has been deprecated.