Load balancing configurations for Splunk Connect for Kafka

Splunk Connect for Kafka supports the following types of load balancing configurations:

• A comma-separated list of HTTP Event Collectors (HEC) endpoints for internal load balancing.
• A preconfigured hardware or software load balancer forwarding requests to HEC endpoints.

Include a load balancer in front of the HECs that are enabled on your Splunk platform indexer cluster or collection of Splunk platform heavy forwarders. Load balancing is supported when HEC token acknowledgment is enabled.

If you are using Splunk Cloud, submit a case on the Splunk Support Portal to create or modify a load balancer for use with Splunk Connect for Kafka. If you are ingesting Kinesis Firehose events, you can reuse the Elastic Load Balancing (ELB) URL that you configured for the Splunk Add-on for Amazon Kinesis Firehose.

If your deployment is configured with load balancing, and HEC acknowledgment is enabled (splunk.hec.ack.enabled:true), follow these steps to ensure data ingests correctly.

1. Enable sticky sessions on your load balancer with the maximum configurable cookie timeout period.
2. Set HEC channels (splunk.hec.total.channels) to multiple HEC endpoints (for example, multiple indexers or 2 * indexers behind your load balancer). This will ensure the data flow is evenly balanced across the Splunk platform indexers.
3. Review indexer polling configurations.
   The parameter splunk.hec.lb.poll.interval controls the load balancer polling interval. By default, it is set to 120 seconds (2 minutes). Users can specify this parameter, in seconds, to control the polling interval. Increase this parameter to do less polling, or decrease it to perform more frequent polling.
4. Save your changes.

Data duplication might occur even with sticky sessions when requests are offloaded to a different endpoint under load.

See the Configuration examples page to see examples of load balancing with a list of HEC enabled endpoints, and load balancing with a preconfigured load balancer.