https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwarder-Connection-to-Indexer/m-p/102900#M21607 <P>As bmacias84 mentions in the other post, if your indexer is down you will lose data, but with a forwarder you can enable the indexer acknowledgement feature. See <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Protectagainstlossofin-flightdata">Protect against loss of in-flight data</A> in the Distributed Deployment Manual.</P> Thu, 25 Oct 2012 18:30:04 GMT ChrisG 2012-10-25T18:30:04Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwarder-Connection-to-Indexer/m-p/102898#M21605 <P>How does the Splunk Universal Forwarder handle the condition when SPLUNK TCP is used as the communication method and the Splunk Indexer is down? (maintenance, someone disconnects the server, ...)</P> Thu, 25 Oct 2012 17:49:29 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwarder-Connection-to-Indexer/m-p/102898#M21605 ezajac 2012-10-25T17:49:29Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwarder-Connection-to-Indexer/m-p/102899#M21606 <P>@ezajac, It depend on your input and your configuration. Here are a couple of post that already cover HA with links to additional read material.</P> <P><A href="http://splunk-base.splunk.com/answers/62679/if-the-receiver-is-down-would-the-data-from-the-universal-forwarder-be-lost?">if-the-receiver-is-down-would-the-data-from-the-universal-forwarder-be-lost</A><BR /> <A href="http://splunk-base.splunk.com/answers/60572/splunk-disaster-recovery?">splunk-disaster-recovery?</A></P> <P>Hope this helps. Cheers.</P> Thu, 25 Oct 2012 18:13:57 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwarder-Connection-to-Indexer/m-p/102899#M21606 bmacias84 2012-10-25T18:13:57Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwarder-Connection-to-Indexer/m-p/102900#M21607 <P>As bmacias84 mentions in the other post, if your indexer is down you will lose data, but with a forwarder you can enable the indexer acknowledgement feature. See <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Protectagainstlossofin-flightdata">Protect against loss of in-flight data</A> in the Distributed Deployment Manual.</P> Thu, 25 Oct 2012 18:30:04 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwarder-Connection-to-Indexer/m-p/102900#M21607 ChrisG 2012-10-25T18:30:04Z