Refine your search:

Hello folks,

I'm trying to puzzle out getting around SPL-34965 (WMI not load balancing), not inundating a single indexer (which is happening right now and screwing up my licensing) and keeping the the networking people happy by not asking for too many external IPs. I see that using an intermediate forwarder (HWF to avoid the done-key issue) is a solution. I completely understand why I wouldn't want to go virtual with the indexers and search head. But, can I get away with going virtual with intermediate forwarders? Does anyone have any anecdotal evidence?

We have about 725 LWFs sending to 3 indexers.

Thanks in advance.

asked 04 Mar '11, 17:39

hacktastic's gravatar image

hacktastic
975
accept rate: 20%


One Answer:

Yes, a VM for an intermediate forwarder should be fine, though you can probably use LWF just fine, as WMI shouldn't have any problems with buffered writes.

link

answered 04 Mar '11, 23:59

gkanapathy's gravatar image

gkanapathy ♦
26.2k1622
accept rate: 42%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×400
×37
×9
×2

Asked: 04 Mar '11, 17:39

Seen: 558 times

Last updated: 04 Mar '11, 23:59

Copyright © 2005-2012 Splunk, Inc. All rights reserved.