topic Re: useack in distributed environment 2 sets of heavy forwaders in Splunk Enterprise

useack in distributed environment 2 sets of heavy forwaders

craigwilkinson — Thu, 10 Jun 2021 09:18:44 GMT

Hi Splunk Support!

We currently have a large Distributed Envirionment where we have 3 sets of Heavy forwarders which have 2 nodes, before hitting an indexer.

Set HFWA --> Has 2 Heavy forwarders

Set HFWB --> has 2 heavy forwarders

Set HFWC --> has 2 heavy forwarders

The data flow goes HFWA ---> HFWB ---> HFWC ---> Indexer.

HFWA outputs.conf has useACK=true.

HFWB & HFWC have useACK=false.

The data flow goes HFWA (useACK=true) ---> HFWB (useACK=false) ---> HFWC(useACK=false) ---> Indexer.

What is the expected output? Will HFWB Give an acknowledgement back to HFWA?

Is this an issue in our environment?

Thanks!

-Craig

Re: useack in distributed environment 2 sets of heavy forwaders

isoutamo — Thu, 10 Jun 2021 17:48:55 GMT

Hi
it’s exactly that way. You should use that same settings on all your uf + hf nodes to take it really into use.
Did you know that your placement is not as Splunk’s best practices said. Optimal configuration is avoid HFS between UFs and indexers.

r. Ismo

Re: useack in distributed environment 2 sets of heavy forwaders

craigwilkinson — Thu, 10 Jun 2021 23:44:42 GMT

Hi could you please explain by "its exactly that way"

If 2 sets of our heavy forwarders have useACK... but 1 of of the set of Heavy Forwarders doesnt have useACK before indexing.. what happens? Will the first 2 set of Heavy forwarders continue to hold the data until an ACK is recieved? Which I assume it enver will, because HFWC doesnt have this enabled?