Deployment Architecture

If the receiver is down, would the data from the Universal Forwarder be lost?

yg
Explorer

If the receiving Splunk is down for some time, would Universal Forwarder keep sending and the data would be lost or it wouldn't be?

Thank you.

Tags (1)

bmacias84
Champion

What do you mean by Splunk? I believe are you referring to the Splunk Indexers, the answer is maybe. This all depends on your input.

If you are monitoring files the answer is no since the UF will pick up where it left off last. Though that does not protect against in-flight data loss. You can protect against in-flight data lost by using indexer acknowledgment.

If you data is streamed such as raw TCP data or Syslog data, yes you could lose data. There are ways to help protect against that. By using indexer acknowledgement and increasing queueSize on both your input.conf and output.conf files.

If you have multiple indexer you can use the UFs built in Auto Load Balancing feature.

Here is a good post on HA: splunk-disaster-recovery

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...