https://community.splunk.com/t5/Getting-Data-In/Does-HEC-data-get-buffered-somewhere/m-p/298422#M56459 <P>Hi, </P> <P>We're thinking about using HEC (either <A href="https://github.com/serilog/serilog-sinks-splunk">Serilog Sink</A> or <A href="http://dev.splunk.com/view/splunk-loglib-dotnet/SP-CAAAEX4">Splunk SDK .Net</A>) to log from an API, insted of developing log files and using a Universal Forwarder. <BR /> But we're highly dependant on that no data is dropped, i.e. if the HEC endpoint is unreachable for some time the solution need to buffer/cache data for the time period, and I can't seem to find any mentions about HEC buffering anywhere in the docs</P> <P>So my question is does HEC offer buffering/cache capability? And in such case, how is that implemented?</P> Mon, 19 Feb 2018 10:35:16 GMT thilleso 2018-02-19T10:35:16Z https://community.splunk.com/t5/Getting-Data-In/Does-HEC-data-get-buffered-somewhere/m-p/298422#M56459 <P>Hi, </P> <P>We're thinking about using HEC (either <A href="https://github.com/serilog/serilog-sinks-splunk">Serilog Sink</A> or <A href="http://dev.splunk.com/view/splunk-loglib-dotnet/SP-CAAAEX4">Splunk SDK .Net</A>) to log from an API, insted of developing log files and using a Universal Forwarder. <BR /> But we're highly dependant on that no data is dropped, i.e. if the HEC endpoint is unreachable for some time the solution need to buffer/cache data for the time period, and I can't seem to find any mentions about HEC buffering anywhere in the docs</P> <P>So my question is does HEC offer buffering/cache capability? And in such case, how is that implemented?</P> Mon, 19 Feb 2018 10:35:16 GMT https://community.splunk.com/t5/Getting-Data-In/Does-HEC-data-get-buffered-somewhere/m-p/298422#M56459 thilleso 2018-02-19T10:35:16Z https://community.splunk.com/t5/Getting-Data-In/Does-HEC-data-get-buffered-somewhere/m-p/298423#M56460 <P>hey thilleso,</P> <P>You can check for this parameter <BR /> persistentQueueSize = [KB|MB|GB|TB]</P> <P>Reference : </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#HTTP_Event_Collector_.28HEC.29_-_Local_stanza_for_each_token">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#HTTP_Event_Collector_.28HEC.29_-_Local_stanza_for_each_token</A></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues">http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues</A></P> <P>Hope this helps!!</P> Mon, 19 Feb 2018 10:40:34 GMT https://community.splunk.com/t5/Getting-Data-In/Does-HEC-data-get-buffered-somewhere/m-p/298423#M56460 deepashri_123 2018-02-19T10:40:34Z