Deployment Architecture

Can a built-in fowarder without configuration options (useAck) connect to a Splunk indexer cluster that uses "useAck"?

gbowden_pheaa
Path Finder

We are trying to connect a Mobileiron built-in Splunk forwarder to an indexer cluster. At best we get an intermittent connection. Whenever we recycle the Mobileiron splunk daemon we see the following message from an indexer:

timestamp INFO TcpInputProc - clustering is enabled but ACK not enabled on forwarder=ip_address

We do not get any other messages after this.

Shouldn't an indexer accept a connection whether useAck is loaded or not from a forwarder? Are there any indexer configurations to accept useAck=false (default)?

0 Karma

schandrasekar
Loves-to-Learn

Hi, I am looking at how to integrate MobileIron Core data to Splunk HFs or Splunk Index cluster. Any leads, please?

0 Karma

Masa
Splunk Employee
Splunk Employee

"""
Shouldn't an indexer accept a connection whether useAck is loaded or not from a forwarder?
Are there any indexer configurations to accept useAck=false (default)?
"""
Yes, Indexer Clustering can accept default (useAck=false) settings. The message is INFO level and not indicating any connection issue.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!