Does HEC-data get buffered somewhere?

[thilleso]

Hi,

We're thinking about using HEC (either Serilog Sink or Splunk SDK .Net) to log from an API, insted of developing log files and using a Universal Forwarder.
But we're highly dependant on that no data is dropped, i.e. if the HEC endpoint is unreachable for some time the solution need to buffer/cache data for the time period, and I can't seem to find any mentions about HEC buffering anywhere in the docs

So my question is does HEC offer buffering/cache capability? And in such case, how is that implemented?

[deepashri_123]

hey thilleso,

You can check for this parameter
persistentQueueSize = [KB|MB|GB|TB]

Reference :

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#HTTP_Event_Collector_.28HEC.29_-...

http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues

Hope this helps!!