Getting Data In

Clarify HEC Indexer Acknowledgement

ro_mc
Path Finder

The link below provides the following paragraph:

"...HEC responds with the status information to the client. The body of the reply contains the status of each of the requests that the client queried. A true status indicates that the event that corresponds to that ackID was replicated at the desired replication factor. A true status does not guarantee that the event was indexed, because the parsing pipeline might drop events that can't be parsed. A false status indicates that there is no status information for that ackID, or that the corresponding event has not been indexed."

Reference: https://docs.splunk.com/Documentation/Splunk/8.2.3/Data/AboutHECIDXAck

This seems contradictory. How can the event for the ackID be replicated at the desired replication factor if it does not guarantee that the event was indexed? However, I noticed that earlier in the documentation, with indexer acknowledgement turned off, it states:

"By default, when HEC receives an event successfully, it immediately sends an HTTP Status 200 code to the sender of the data. However, this only means that the event data appears to be valid, and HEC sends the status message before the event data enters the processing pipeline."

Does the lack of guarantee only refer to when acknowledgement is NOT enabled? I.e. does an ackID value of "True" guarantee that the data has been indexed (and replicated) successfully?

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When you have questions, comments, or are confused about Splunk documentation, the best action is to submit Feedback on the page.  The Splunk Docs team is excellent about responding to user feedback.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When you have questions, comments, or are confused about Splunk documentation, the best action is to submit Feedback on the page.  The Splunk Docs team is excellent about responding to user feedback.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...