Usually on port 9997, splunktcp is itself stateless. Splunk auto load balancing is very well tested and very efficient but does not support complicated logic. For instance, you could use a load balancer to prefer connections to the indexers in the same data center, only using indexers in another data center as a last resort.
The problem is that when only one address is provided to a Splunk forwarder, the forwarder will open one connection, and keep it open indefinitely. This means that when an indexer is restarted, it will never receive a connection until the forwarders are restarted.
The easy solution is to expose two addresses on your load balancer and list both of these addresses in outputs.conf. The two addresses must either be two different ports or two different IP addresses. Two different CNAMEs on the same port will not work, as Splunk resolves the addresses and collapses the list of IP addresses.