TCP Input or SQL for Websense Security Logs

[aelliott]

To feed logs from Websense to Splunk, which would be ideal and why?
As a TCP Input
From MSSQL

If Splunk server goes down, will logs be lost using the TCP input?

[aelliott · Accepted solution]

Since I have seen some posts that say that SQL Logs are the way to go, and TCP inputs have the possibility of losing data if the splunk server were to go down. I am going to say that the better way is through MSSQL as it will pick up where it left off.