Hello,
We have set up a small splunk cluster, with 3 indexers getting data from universal forwarder, which is configured for output as
[tcpout:default-autolb-group]
autoLBFrequency=40
server = pc-tdq-bst-04:9995, pc-tdq-bst-05:9995, pc-tdq-sfo-06:9995
as for input as
[script:///opt/splunkforwarder/bin/scripts/pbeast_injector.sh <parameters>]
The script never stops, it gets data from an external online monitoring system. After having indexed many events in few days, we realized that majority of events were indexed by first indexer in the list, pc-tdq-bst-04. E.g. a typical query returns stats like this:
dispatch.stream.remote.pc-tdq-bst-04.cern.ch 220 - 68,031,902
dispatch.stream.remote.pc-tdq-bst-05.cern.ch 2 - 4,584
dispatch.stream.remote.pc-tdq-sfo-06.cern.ch 1 - 2,386
The indexers are almost identical and have sufficient disk space. Earlier they were used for indexing the files, and the load was randomly distributed, but behavior of the script input is quite different.
Is there a way to enforce sort of round-robin balancing for the [script] input, given that the script is running permanently?
Thanks Andrei
