Skip to main content
 
 
Splunk Lantern

Load balancer data

 

Load balancers allocate external network traffic bound for a particular server or application across multiple redundant instances. Load balancer logs provide operations teams with a record of overall traffic to systems or particular applications and provide indicators of each system’s traffic-handling capacity and health, along with the status and health of the load balancer itself. There are two categories of load balancer: local, in which all resources in a load-balanced pool are on the same subnet; and global or distributed, where the resource pool is spread across multiple sites. In the Common Information Model, load balancer data is typically mapped to the Inventory data model

An application load balancer functions at the application layer, the seventh layer of the Open Systems Interconnection (OSI) model. After the load balancer receives a request, it evaluates the listener rules in priority order to determine which rule to apply, and then selects a target from the target group for the rule action. You can configure listener rules to route requests to different target groups based on the content of the application traffic. Routing is performed independently for each target group, even when a target is registered with multiple target groups.

A DNS Global Load Balancer (more commonly known as GSLB for Global Server Load Balancing) works at the DNS level to distribute requests. Each datacenter has its own GSLB server, and all of the servers broadcast an identical IP address to the Internet. Any request for this IP address is automatically routed to the closest server via BGP. That server then chooses where to direct the user depending on the designated load-balancing ratio. After a site has been chosen, the server responds to the user's request with the IP address of the local load-balancing pool at that site.

Before looking at documentation for specific data sources, review the Splunk Docs information on general data ingestion: