topic Re: What does the heartbeatFrequency setting do in outputs.conf? in Getting Data In

What does the heartbeatFrequency setting do in outputs.conf?

splunkn — Thu, 08 Oct 2015 16:24:08 GMT

What does it actually mean and what are its use cases? Is this different from autoLfrequency?
From Docs, I can infer that if sendCookedData=true, then it should be enabled. What is the relation between them?

Does it do something to detect lost forwarder connection to indexer?

Thanks in advance.

Re: What does the heartbeatFrequency setting do in outputs.conf?

rphillips_splk — Thu, 08 Oct 2015 16:55:20 GMT

in reference to the outputs.conf spec file http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Outputsconf

heartbeatFrequency = <integer>
* How often (in seconds) to send a heartbeat packet to the receiving server.
* Heartbeats are only sent if sendCookedData=true.
* Defaults to 30 (seconds).

It is a mechanism for the forwarder to to know that the receiver (ie indexer) is alive. If the indexer does not send a return packet to the forwarder, the forwarder will declare this receiver unreachable and not forward data to it. By default a packet is sent every 30s.

Re: What does the heartbeatFrequency setting do in outputs.conf?

wrangler2x — Thu, 25 Oct 2018 15:46:46 GMT

@rphillips_splunk What port on the forwarder does the indexer send this return packet to?