https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-use-useACK-in-outputs-conf/m-p/539483#M90374 <P>It depends on your goals.&nbsp; To prevent data loss, useACK is recommended.&nbsp; Acknowledgement increases the chances of data duplication, however, so that needs to be accounted for in searches.&nbsp; Choose to use useACK based on which scenario is least painful to you.</P> Thu, 11 Feb 2021 14:17:48 GMT richgalloway 2021-02-11T14:17:48Z https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-use-useACK-in-outputs-conf/m-p/539302#M90349 <P>I have inherited a SPlunk environment and one thing i've noticed is that one all of our heavy forwarders are using useACK.&nbsp; Is this best practice? we are seeing duplicate events due to this, and I wanted to see if I should work on tailoring the config for indexer acknowledgement, or if I should just disable it and move on.&nbsp;</P> Wed, 10 Feb 2021 14:02:34 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-use-useACK-in-outputs-conf/m-p/539302#M90349 ekenne06 2021-02-10T14:02:34Z https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-use-useACK-in-outputs-conf/m-p/539483#M90374 <P>It depends on your goals.&nbsp; To prevent data loss, useACK is recommended.&nbsp; Acknowledgement increases the chances of data duplication, however, so that needs to be accounted for in searches.&nbsp; Choose to use useACK based on which scenario is least painful to you.</P> Thu, 11 Feb 2021 14:17:48 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-use-useACK-in-outputs-conf/m-p/539483#M90374 richgalloway 2021-02-11T14:17:48Z