Deployment Architecture

If the receiver is down, would the data from the Universal Forwarder be lost?


If the receiving Splunk is down for some time, would Universal Forwarder keep sending and the data would be lost or it wouldn't be?

Thank you.

Tags (1)


What do you mean by Splunk? I believe are you referring to the Splunk Indexers, the answer is maybe. This all depends on your input.

If you are monitoring files the answer is no since the UF will pick up where it left off last. Though that does not protect against in-flight data loss. You can protect against in-flight data lost by using indexer acknowledgment.

If you data is streamed such as raw TCP data or Syslog data, yes you could lose data. There are ways to help protect against that. By using indexer acknowledgement and increasing queueSize on both your input.conf and output.conf files.

If you have multiple indexer you can use the UFs built in Auto Load Balancing feature.

Here is a good post on HA: splunk-disaster-recovery

Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...