search

splunk / splunk-connect-for-syslog

Splunk Connect for Syslog
Apache License 2.0
152 stars 107 forks source link

Documentation conflict regarding load balancers #2358

Closed splaarmy closed 2 months ago

splaarmy commented 6 months ago

Describe the bug SC4S documentation mentions not using load-balancers in a few places, such as https://splunk.github.io/splunk-connect-for-syslog/main/lb/, however on the page linked below seems to list a load-balancer as a prerequisite:

A network load balancer (NLB) configured for round-robin. Note: Special consideration may be required when more advanced products are used. The optimal configuration of the load balancer will round-robin each http POST request (not each connection).

https://splunk.github.io/splunk-connect-for-syslog/main/gettingstarted/getting-started-runtime-configuration/

To Reproduce Steps to reproduce the behavior:

  1. Go to https://splunk.github.io/splunk-connect-for-syslog/main/gettingstarted/getting-started-runtime-configuration
  2. Item in question is currently the second paragraph in the Prerequisite section.
fyodorr commented 6 months ago

The loadbalancers in this case have different usages.

The loadbalancer that's recommended is the load balancer for balancing the http (HEC) traffic to indexers.

The loadbalancer that's not recommended is the load balancer that's placed infront of the syslog server (SC4S).

rjha-splunk commented 5 months ago

We are working on documentation , we will update the sections to make it more clear cc: @mstopa-splunk

rjha-splunk commented 2 months ago

The clarification documentation is merged.