Some organizations that have invested heavily in load balancers like to use them whenever possible to centralize network management. There are three services Splunk typically exposes, mentioned in the following sections:
Usually on port 8000, the Splunk web server can be load balanced when configured with search head pooling. The load balancer should be configured to be "sticky", as the web server will still rely on user sessions tied to the web server the user started on.
See the Multiple search heads section for more information.
Usually on port 9997,
splunktcp is itself stateless. Splunk auto load balancing is very well tested and very efficient but does not support complicated logic. For instance, you could ...