I have a forwarder that forwards to two different Splunk systems: SplunkA and SplunkB. The data coming into the forwarder is TCP data on two different ports, port A and port B. All data on port A is forwarded to SplunkA and all data on port B is forwarded to SplunkB.
I configured persistent queuing on both ports.
Then I shutdown SplunkA. I found that both both port A and port B data was queued. That means that none of the TCP data on port B was getting to SplunkB, even though SplunkB was up.
Is this expected behavior?
