Öykü Can

Worked on

1. 26 September 20267 min read

   How We Stopped One Splunk Forwarder From Taking All the Traffic

   Use of HAProxy, keepalived, and rsyslog to ensure even distribution of both syslog and HEC traffic on three Splunk Heavy Forwarders and how we managed to overcome TCP connection stickiness and absence of the source IP.

   • ÖCÖykü Can
   • TGTahsin Güner