topic Re: How to avoid data loss on HF on restart in Getting Data In

How to avoid data loss on HF on restart

AnilPujar — Thu, 08 Nov 2018 06:21:25 GMT

I have service now add on, db connect in Heavy Forwarder. So i cant use multiple instances of HF to avoid data duplication and licensing. My both apps Service Now and DB connect are in real time sync, also I need to do changes in props & transforms frequently. so in this case how to avoid data loss. Just using indexer ack will resolve?

Re: How to avoid data loss on HF on restart

FrankVl — Thu, 08 Nov 2018 08:41:22 GMT

I took the liberty of changing your post to a new question, instead of an answer to https://answers.splunk.com/answers/674341/missing-of-events-and-flooding-of-data-in-heavy-fo.html

To better understand your situation: why do you have frequent props/transforms changes that require a restart? Does this HF do other tasks, besides the SN and DBX apps (e.g. routing data from other forwarders or so)?

Re: How to avoid data loss on HF on restart

sahilyahiya — Tue, 28 Jan 2020 05:30:06 GMT

Hi Frank,
Since I am also expecting an answer to a similar question, please find the details below.

When we add a new HEC via inputs.conf in HF, we have a setting restartSplunkd = true in Serverclass associated with HEC app. So whenever we add a new HEC, we need to restart the HF's that is used to collect the HTTP inputs.

Can we use restartSplunkd = false while adding a new inputs.conf ?

Re: How to avoid data loss on HF on restart

esix_splunk — Tue, 28 Jan 2020 07:27:25 GMT

This is addressed partially in 8.0.1 and coming in 7.2.10, adding and removing inputs for HEC will no longer require a restart!