Clarify HEC Indexer Acknowledgement

[ro_mc]

The link below provides the following paragraph:

"...HEC responds with the status information to the client. The body of the reply contains the status of each of the requests that the client queried. A true status indicates that the event that corresponds to that ackID was replicated at the desired replication factor. A true status does not guarantee that the event was indexed, because the parsing pipeline might drop events that can't be parsed. A false status indicates that there is no status information for that ackID, or that the corresponding event has not been indexed."

Reference: https://docs.splunk.com/Documentation/Splunk/8.2.3/Data/AboutHECIDXAck

This seems contradictory. How can the event for the ackID be replicated at the desired replication factor if it does not guarantee that the event was indexed? However, I noticed that earlier in the documentation, with indexer acknowledgement turned off, it states:

"By default, when HEC receives an event successfully, it immediately sends an HTTP Status 200 code to the sender of the data. However, this only means that the event data appears to be valid, and HEC sends the status message before the event data enters the processing pipeline."

Does the lack of guarantee only refer to when acknowledgement is NOT enabled? I.e. does an ackID value of "True" guarantee that the data has been indexed (and replicated) successfully?

[richgalloway · Accepted solution]

When you have questions, comments, or are confused about Splunk documentation, the best action is to submit Feedback on the page.  The Splunk Docs team is excellent about responding to user feedback.