https://community.splunk.com/t5/Getting-Data-In/Configuration-for-heavy-forwarder-to-store-events-locally-when/m-p/330035#M61177 <P>Dears,</P> <P>may i know how to configure splunk Heavy forwarder to store events locally in case of indexer unavailable ?</P> Mon, 30 Oct 2017 22:59:08 GMT ahmedhassanean 2017-10-30T22:59:08Z https://community.splunk.com/t5/Getting-Data-In/Configuration-for-heavy-forwarder-to-store-events-locally-when/m-p/330035#M61177 <P>Dears,</P> <P>may i know how to configure splunk Heavy forwarder to store events locally in case of indexer unavailable ?</P> Mon, 30 Oct 2017 22:59:08 GMT https://community.splunk.com/t5/Getting-Data-In/Configuration-for-heavy-forwarder-to-store-events-locally-when/m-p/330035#M61177 ahmedhassanean 2017-10-30T22:59:08Z https://community.splunk.com/t5/Getting-Data-In/Configuration-for-heavy-forwarder-to-store-events-locally-when/m-p/330036#M61178 <P>Hi ahmedhassanean,<BR /> if your requirement is to be sure that events will not be lost, you don't need any special configuration: Forwarders (Universal or Heavy) by default locally cache events when Indexers are down.<BR /> For this reason, if I must ingest syslogs I prefer to use two Heavy Forwarders instead directly receive logs on Indexers.</P> <P>If instead your requirement is to access to events in search when an indexer is down, your question isn't a solution: in this case you have to configure an Indexers cluster.</P> <P>Bye.<BR /> Giuseppe</P> Tue, 31 Oct 2017 07:45:14 GMT https://community.splunk.com/t5/Getting-Data-In/Configuration-for-heavy-forwarder-to-store-events-locally-when/m-p/330036#M61178 gcusello 2017-10-31T07:45:14Z