Light forwarder behavior when one indexer is down (autolb disabled)

[anantshah]

Hello,

We are currently using light forwarders on our web boxes to forward iis logs to two indexers. One of the indexers went down and when it came back up, it did not receive data from during the outage. The 2nd indexer did not have any problems. Is this expected behavior? Does the forwarder buffer events for one indexer if the second one is up? Both indexers are independent.

[the_wolverine · Accepted solution]

In a cloning situation, if one indexer were to go down, Splunk will not buffer the events. As you have experienced, it will continue to send events to the other indexer.

http://www.splunk.com/wiki/Community:HighAvailabilityAndSplunk

There is the issue where the data on your indexers will be out-of-sync when such a situation arises.