https://community.splunk.com/t5/Getting-Data-In/Does-a-universal-forwarder-s-persistent-queue-exist-after-a/m-p/225629#M44110 <P>According to this document: <A href="http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/Usepersistentqueues">http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/Usepersistentqueues</A> </P> <BLOCKQUOTE> <P>The in-memory data can get lost if a crash occurs. Similarly, data that is in the parsing or indexing pipeline but that has not yet been written to disk can get lost in the event of a crash. </P> </BLOCKQUOTE> <P>This only refers to a 'crash'. Does Splunk write the 500K of cached data to the persistent queue in the event of a clean shutdown of the forwarder or the machine?</P> Wed, 10 Aug 2016 17:54:17 GMT dflodstrom 2016-08-10T17:54:17Z https://community.splunk.com/t5/Getting-Data-In/Does-a-universal-forwarder-s-persistent-queue-exist-after-a/m-p/225629#M44110 <P>According to this document: <A href="http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/Usepersistentqueues">http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/Usepersistentqueues</A> </P> <BLOCKQUOTE> <P>The in-memory data can get lost if a crash occurs. Similarly, data that is in the parsing or indexing pipeline but that has not yet been written to disk can get lost in the event of a crash. </P> </BLOCKQUOTE> <P>This only refers to a 'crash'. Does Splunk write the 500K of cached data to the persistent queue in the event of a clean shutdown of the forwarder or the machine?</P> Wed, 10 Aug 2016 17:54:17 GMT https://community.splunk.com/t5/Getting-Data-In/Does-a-universal-forwarder-s-persistent-queue-exist-after-a/m-p/225629#M44110 dflodstrom 2016-08-10T17:54:17Z https://community.splunk.com/t5/Getting-Data-In/Does-a-universal-forwarder-s-persistent-queue-exist-after-a/m-p/225630#M44111 <P>Yes, part of the shutdown of the service is to wait for all queues to finish. This is why Splunkd can take longer to restart at times, you can watch this happening in the logs.</P> Wed, 10 Aug 2016 17:57:10 GMT https://community.splunk.com/t5/Getting-Data-In/Does-a-universal-forwarder-s-persistent-queue-exist-after-a/m-p/225630#M44111 jonathan_cooper 2016-08-10T17:57:10Z https://community.splunk.com/t5/Getting-Data-In/Does-a-universal-forwarder-s-persistent-queue-exist-after-a/m-p/225631#M44112 <P>Excellent. Thanks, Cooper! We're thinking about installing UFs on laptops and this was one of our concerns.</P> Wed, 10 Aug 2016 18:08:57 GMT https://community.splunk.com/t5/Getting-Data-In/Does-a-universal-forwarder-s-persistent-queue-exist-after-a/m-p/225631#M44112 dflodstrom 2016-08-10T18:08:57Z