Deployment Architecture

If the receiver is down, would the data from the Universal Forwarder be lost?

yg
Explorer

If the receiving Splunk is down for some time, would Universal Forwarder keep sending and the data would be lost or it wouldn't be?

Thank you.

Tags (1)

bmacias84
Champion

What do you mean by Splunk? I believe are you referring to the Splunk Indexers, the answer is maybe. This all depends on your input.

If you are monitoring files the answer is no since the UF will pick up where it left off last. Though that does not protect against in-flight data loss. You can protect against in-flight data lost by using indexer acknowledgment.

If you data is streamed such as raw TCP data or Syslog data, yes you could lose data. There are ways to help protect against that. By using indexer acknowledgement and increasing queueSize on both your input.conf and output.conf files.

If you have multiple indexer you can use the UFs built in Auto Load Balancing feature.

Here is a good post on HA: splunk-disaster-recovery

Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...