https://community.splunk.com/t5/Deployment-Architecture/Splunk-Universal-Forwarder-Data-Recovery-Following-a-Network/m-p/179625#M6683 <P>Splunk operates over TCP, so you don't lose data, although if your network outage lasts a long time you can find it starts chewing through memory. Once the connection restores it will eventually catch up automatically (provided it has the bandwidth).</P> Tue, 12 Aug 2014 22:58:54 GMT grijhwani 2014-08-12T22:58:54Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-Universal-Forwarder-Data-Recovery-Following-a-Network/m-p/179624#M6682 <P>Hi,</P> <P>Just wondering if anyone has encountered the following issue. </P> <P>I want to setup a distributed Splunk environment consisting of one indexer and multiple forwarders, let's say 6. The forwarders will be installed on a different network and must pass through a firewall in order to contact the indexer. If, for some reason, the network drops and the forwarders are unable to contact the indexer, what happends in this case?</P> <P>-Do the forwarders stop sending data immediately? </P> <P>-Will I lose some data from the files that the forwarders are monitoring? </P> <P>-Is there a clean and elegant way to synchronize the files being monitored by the forwarders and the events on the indexer? </P> <P>I am trying to setup Splunk on a production environment and having all of the events produced on the servers is crucial. </P> <P>Has anyone had a similar issue and found a reliable solution?</P> <P>Any help would be greatly appreciated!</P> <P>Thanks!</P> Tue, 12 Aug 2014 21:17:49 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-Universal-Forwarder-Data-Recovery-Following-a-Network/m-p/179624#M6682 splunkmasterfle 2014-08-12T21:17:49Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-Universal-Forwarder-Data-Recovery-Following-a-Network/m-p/179625#M6683 <P>Splunk operates over TCP, so you don't lose data, although if your network outage lasts a long time you can find it starts chewing through memory. Once the connection restores it will eventually catch up automatically (provided it has the bandwidth).</P> Tue, 12 Aug 2014 22:58:54 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-Universal-Forwarder-Data-Recovery-Following-a-Network/m-p/179625#M6683 grijhwani 2014-08-12T22:58:54Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-Universal-Forwarder-Data-Recovery-Following-a-Network/m-p/179626#M6684 <P>Is this information taken from the splunk documentation ?</P> Thu, 14 Aug 2014 20:49:40 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-Universal-Forwarder-Data-Recovery-Following-a-Network/m-p/179626#M6684 splunkmasterfle 2014-08-14T20:49:40Z