Splunk forwarders are responsible for load balancing across indexers. This is accomplished most simply by providing a list of indexers in outputs.conf, as shown in the following code:
[tcpout:nyc] server=nyc-splunk-index01:9997,nyc-splunk-index02:9997
If an indexer is unreachable, the forwarder will simply choose another indexer in the list. This scheme works very well and powers most Splunk deployments. If the DNS entry returns multiple addresses, Splunk will balance between the addresses on the port specified.
By default, the forwarder will use auto load balancing, specified by autoLB=true. Essentially, the forwarder will switch between indexers on a timer. This is the only option available for the universal forwarder ...
