A company moves to a distributed architecture to meet the growing demand for the use of Splunk. What parameter can be configured to enable automatic load balancing in the Universal Forwarder to send…

Question

Options

• ACreate one outputs . conf file for each of the server addresses in the indexing tier.
• BConfigure the outputs . conf file to point to any server in the indexing tier and Splunk will configure
• CSplunk does not do load balancing and requires a hardware load balancer to balance traffic
• DSet the stanza to have a server value equal to a comma-separated list of IP addresses and

• A
  4% (2)
• C
  2% (1)
• D
  93% (42)

Explanation

In outputs.conf, within the [tcpout:<target_group>] stanza, you set the 'server' parameter to a comma-separated list of indexer addresses (e.g., server = 10.0.0.1:9997, 10.0.0.2:9997, 10.0.0.3:9997). Splunk's Universal Forwarder then automatically performs load balancing across those indexers based on the autoLBFrequency setting. Option A is incorrect-creating one outputs.conf per server would not achieve load balancing and is not a valid architecture. Option B is incorrect-Splunk does not auto-discover indexers; you must explicitly list them. Option C is incorrect-Splunk does natively support load balancing in outputs.conf without requiring a hardware load balancer.

No community discussion yet for this question.