https://community.splunk.com/t5/Getting-Data-In/HF-data-forwarding-to-3rd-party-design-validation/m-p/470147#M80856 <P>I have a requirement to push a subset of universal and heavy forwarders originating data to a third party, for which I enabled a set of HFs for data forwarding alone.</P> <P>This is working fine, as data arrives uncooked to a target <CODE>syslog-ng</CODE>.</P> <P>The troublesome part was being asked to ensure the HF resends the data in case the target undergoes maintenance, or has an outage lasting up to 2 days.</P> <P>Considering Persistent Queues don't work over <CODE>splunktcp</CODE> streams, is it even an option for me to push uncooked data to the HFs, enabling a standard TCP input (not <CODE>splunktcp</CODE>) with Persistent Queue enabled, say, to 200GB?</P> <P>Never heard of anyone using this approach.<BR />Would this work?</P> Sun, 07 Jun 2020 00:06:41 GMT splunk_zen 2020-06-07T00:06:41Z https://community.splunk.com/t5/Getting-Data-In/HF-data-forwarding-to-3rd-party-design-validation/m-p/470147#M80856 <P>I have a requirement to push a subset of universal and heavy forwarders originating data to a third party, for which I enabled a set of HFs for data forwarding alone.</P> <P>This is working fine, as data arrives uncooked to a target <CODE>syslog-ng</CODE>.</P> <P>The troublesome part was being asked to ensure the HF resends the data in case the target undergoes maintenance, or has an outage lasting up to 2 days.</P> <P>Considering Persistent Queues don't work over <CODE>splunktcp</CODE> streams, is it even an option for me to push uncooked data to the HFs, enabling a standard TCP input (not <CODE>splunktcp</CODE>) with Persistent Queue enabled, say, to 200GB?</P> <P>Never heard of anyone using this approach.<BR />Would this work?</P> Sun, 07 Jun 2020 00:06:41 GMT https://community.splunk.com/t5/Getting-Data-In/HF-data-forwarding-to-3rd-party-design-validation/m-p/470147#M80856 splunk_zen 2020-06-07T00:06:41Z