Getting Data In

Can you help me with a question about persistent queuing with multiple tcp ports?

Path Finder

I have a forwarder that forwards to two different Splunk systems: SplunkA and SplunkB. The data coming into the forwarder is TCP data on two different ports, port A and port B. All data on port A is forwarded to SplunkA and all data on port B is forwarded to SplunkB.

I configured persistent queuing on both ports.

Then I shutdown SplunkA. I found that both both port A and port B data was queued. That means that none of the TCP data on port B was getting to SplunkB, even though SplunkB was up.

Is this expected behavior?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!