topic Setting useACK in outputs.conf in a Distributed Environment (Universal Forwarder + Heavy Forwarder + Indexer) in Splunk Enterprise

Setting useACK in outputs.conf in a Distributed Environment (Universal Forwarder + Heavy Forwarder + Indexer)

edoardo_vicendo — Wed, 14 Apr 2021 15:18:13 GMT

Hello,

In a distributed environment with Universal Forwarder, Heavy Forwarder and Indexers, like this one:

UF --> HF --> IDX

How do you set useACK=true in outputs.conf ?

Is it needed to be enabled both on Universal Forwarder and Heavy Forwarder?

We currently have it enabled only on the Heavy Forwarder.

Thanks a lot,

Edoardo

Re: Setting useACK in outputs.conf in a Distributed Environment (Universal Forwarder + Heavy Forwarder + Indexer)

richgalloway — Wed, 14 Apr 2021 19:21:27 GMT

As I understand it, the instance with useACK=true will buffer packets until they are acknowledged by the indexer. If useACK=false then the packet is discarded once it is sent. (These are Splunk packets, not TCP packets.) Also, useACK adds a kind of flow control to the data stream. For better end-to-end control, use useACK=true on the UF and HF. Note that this will force the instance to use more memory.

Re: Setting useACK in outputs.conf in a Distributed Environment (Universal Forwarder + Heavy Forwarder + Indexer)

edoardo_vicendo — Thu, 20 May 2021 16:20:00 GMT

Thank you, is well described here:

https://docs.splunk.com/Documentation/Forwarder/8.2.0/Forwarder/Protectagainstthelossofin-flightdata#When_the_receiver_is_a_forwarder