Getting Data In

Does HEC-data get buffered somewhere?

Path Finder


We're thinking about using HEC (either Serilog Sink or Splunk SDK .Net) to log from an API, insted of developing log files and using a Universal Forwarder.
But we're highly dependant on that no data is dropped, i.e. if the HEC endpoint is unreachable for some time the solution need to buffer/cache data for the time period, and I can't seem to find any mentions about HEC buffering anywhere in the docs

So my question is does HEC offer buffering/cache capability? And in such case, how is that implemented?

0 Karma

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!