Load Balancing Overview
In Splunk platform environments with multiple servers, each with their own configured HEC endpoints; a physical or logical load balancer is needed to distribute each request to each Splunk platform server. The collection of HEC endpoints can reside on either a cluster of Splunk heavy forwarders or Splunk indexers, depending on the specific environment configuration. If you use a load balancer, the address of the load balancer needs to be configured in the setting for HTTP Event Collector Endpoint (HEC) URL found on the Splunk Settings configuration page.
Performance and Sizing
This documentation applies to the following versions of Splunk® Firehose Nozzle for VMware Tanzu: 1.3.0