load balancing

noun

The activity by which a forwarder distributes its data stream across multiple receiving Splunk indexers in a predefined group. For instance, if a load-balanced group of three receiving indexers has been defined, the forwarder will switch from one indexer to another after a specified interval. Each indexer receives a slice of the data. Together, the load-balanced group holds the full data stream.

Load balancing has several key uses. In particular, it enables horizontal scaling for improved performance. It also ensures resiliency in the face of machine outages. If an indexer goes down, the forwarder immediately begins sending data to the next available indexer in the load-balanced group.

When forwarding data to a cluster, load balancing is a key strategy for dealing with potential node failure.

There are two types of load balancing: automatic and round-robin. In automatic load balancing, the forwarder uses a specified time interval to determine when to begin sending data to another receiving indexer. In round-robin load balancing, the forwarder switches to a new receiver with each new event. In nearly all cases, automatic load balancing is a better solution.

Important: Starting with release 4.2, round-robin load balancing has been deprecated.