https://community.splunk.com/t5/Getting-Data-In/Is-safe-the-events-saved-in-forwarder-s-queue-when-the-splunk/m-p/72411#M14769 <P>I configure a port 9997 on a splunk server to receive a forwarder 's event. The forwarder will transfer all event continuously. I want to schedule a forwarder transfer. <BR /> I close the splunk receiver port at a special time and open at another special time, <BR /> The forwarder will be blocked when the port is closed. All events will enter a queue. maxQueueSize can configure the size of the queue. is it right?<BR /> Is safe the events saved in forwarder's queue?<BR /> Where the events is saved? memory or disk?<BR /> What is the performance of the forwarder when it is blocked.</P> Thu, 27 Sep 2012 02:43:06 GMT shizl 2012-09-27T02:43:06Z https://community.splunk.com/t5/Getting-Data-In/Is-safe-the-events-saved-in-forwarder-s-queue-when-the-splunk/m-p/72411#M14769 <P>I configure a port 9997 on a splunk server to receive a forwarder 's event. The forwarder will transfer all event continuously. I want to schedule a forwarder transfer. <BR /> I close the splunk receiver port at a special time and open at another special time, <BR /> The forwarder will be blocked when the port is closed. All events will enter a queue. maxQueueSize can configure the size of the queue. is it right?<BR /> Is safe the events saved in forwarder's queue?<BR /> Where the events is saved? memory or disk?<BR /> What is the performance of the forwarder when it is blocked.</P> Thu, 27 Sep 2012 02:43:06 GMT https://community.splunk.com/t5/Getting-Data-In/Is-safe-the-events-saved-in-forwarder-s-queue-when-the-splunk/m-p/72411#M14769 shizl 2012-09-27T02:43:06Z https://community.splunk.com/t5/Getting-Data-In/Is-safe-the-events-saved-in-forwarder-s-queue-when-the-splunk/m-p/72412#M14770 <P>By default the forwarder has a small memory queue, and will resent the events once an indexer is available.<BR /> If the forwarder is monitoring non volatile logs (i.e. not UDP) then it will pause the monitoring until the output is available. <BR /> But for the events already in memory, they can be lost if the forwarder is shut down.</P> <P>FYI you can add persistent queues on disk<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/Usepersistentqueues">http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/Usepersistentqueues</A></P> Thu, 27 Sep 2012 16:48:02 GMT https://community.splunk.com/t5/Getting-Data-In/Is-safe-the-events-saved-in-forwarder-s-queue-when-the-splunk/m-p/72412#M14770 yannK 2012-09-27T16:48:02Z