https://community.splunk.com/t5/Getting-Data-In/Heavy-forwarder/m-p/566968#M100743 <P>See&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues</A></P> Tue, 14 Sep 2021 12:32:12 GMT richgalloway 2021-09-14T12:32:12Z https://community.splunk.com/t5/Getting-Data-In/Heavy-forwarder/m-p/566951#M100741 <DIV class="j83agx80 l9j0dhe7 du4w35lb aovydwv3 do00u71z"><DIV class="l9j0dhe7 i09qtzwb esma6hys j83agx80"><DIV><DIV class="nred35xi ue3kfks5 pw54ja7n jinzq4gt mrjvor2e eu4i7hue jq4qci2q a3bd9o3v ni8dbmo4 stjgntxs gu00c43d jbcpqwzg fh5enmmv kwja4m9d la0exbxb l8e2pc74"><DIV class="iqfcb0g7 tojvnm2t a6sixzi8 k5wvi7nf q3lfd5jv pk4s997a bipmatt0 cebpdrjk qowsmv63 owwhemhu dp1hu0rb dhp61c6y l9j0dhe7 iyyx5f41 a8s20v7p"><DIV class="datstx6m iqfcb0g7"><DIV class="datstx6m j83agx80 cbu4d94t ni8dbmo4 stjgntxs fbhpx0h9"><DIV class="rj1gh0hx buofh1pr j83agx80 cbu4d94t d2edcug0 l9j0dhe7 du4w35lb"><DIV class="rq0escxv buofh1pr l9j0dhe7 j83agx80 cbu4d94t"><DIV class="rj1gh0hx buofh1pr j83agx80 l9j0dhe7 cbu4d94t ni8dbmo4 stjgntxs"><DIV class="rj1gh0hx buofh1pr l9j0dhe7 j83agx80 cbu4d94t agkhgkm8"><DIV class="rj1gh0hx buofh1pr ni8dbmo4 stjgntxs j83agx80 cbu4d94t"><DIV class="buofh1pr j83agx80 eg9m0zos ni8dbmo4 cbu4d94t gok29vw1 isf3ygkp"><DIV class="ns9esd28 tqkqlopc du4w35lb"><DIV class="l9j0dhe7"><DIV class=""><DIV class="j83agx80 cbu4d94t l9j0dhe7"><DIV class="j83agx80"><DIV class="j83agx80 buofh1pr rl25f0pe o6b9zlra"><DIV class="ns4p8fja j83agx80 cbu4d94t a6sixzi8 bkfpd7mw jit8km0v"><DIV class="aovydwv3 j83agx80 cbu4d94t d2edcug0 l9j0dhe7"><DIV class="j83agx80 k4urcfbm"><DIV class="l60d2q6s d1544ag0 sj5x9vvc tw6a2znq l9j0dhe7 ni8dbmo4 stjgntxs e72ty7fz qlfml3jp inkptoze qmr60zad jm1wdb64 qv66sw1b ljqsnud1 odn2s2vf tkr6xdv7"><DIV class="rq0escxv l9j0dhe7 du4w35lb __fb-light-mode"><DIV class="ljqsnud1 ii04i59q">we have indexer , search head and heavy forwarder in a vessel , the heavy forwarder will send the data to a head office , but due to the vessel is moving in international water or far from the head office , the head office indexers disconnected from the vessel , we know the heavy forwarder buffer the data until the indexers became available again , but the buffer is in memory(RAM) , and the buffered data will be very large -as the vessel disconnected long time -so the memory may be full and heavy forwarder will crash , now my question, do we can make the heavy forwarder buffer the data on the hard disk not on the memory ,or any other solution to this case ?</DIV></DIV></DIV></DIV></DIV><DIV class="ns4p8fja j83agx80 cbu4d94t a6sixzi8 bkfpd7mw d2edcug0 kb5gq1qc nred35xi">&nbsp;</DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV> Tue, 14 Sep 2021 08:19:41 GMT https://community.splunk.com/t5/Getting-Data-In/Heavy-forwarder/m-p/566951#M100741 Karim_Hamdy 2021-09-14T08:19:41Z https://community.splunk.com/t5/Getting-Data-In/Heavy-forwarder/m-p/566968#M100743 <P>See&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues</A></P> Tue, 14 Sep 2021 12:32:12 GMT https://community.splunk.com/t5/Getting-Data-In/Heavy-forwarder/m-p/566968#M100743 richgalloway 2021-09-14T12:32:12Z https://community.splunk.com/t5/Getting-Data-In/Heavy-forwarder/m-p/566969#M100744 <P>unfortunately&nbsp;<SPAN>Persistent queuing is available for certain types of inputs, but not all</SPAN></P> Tue, 14 Sep 2021 12:34:00 GMT https://community.splunk.com/t5/Getting-Data-In/Heavy-forwarder/m-p/566969#M100744 Karim_Hamdy 2021-09-14T12:34:00Z