How do I configure my SplunkForwarder to have the least impact in the case my index server is unavailable?

[cpenkert]

We have run into a few cases over the last year where our index server is unavailable (either disk is full or offline for maintenance). During that time, we see the SplunkForwarder on our Windows 2008 servers consume 1-2 entire CPU's at 100% each.

Understanding that one solution (that I won't get money approved to do) would be to have redundancy at the indexer level....

I'm looking for tips on Forwarder configurations (I'm guessing via outpus.conf) that will minimize the performance impact on the Forwarding machine in the case that the indexer is unavailable. I've read some things in the documentation, but I'm hoping for some more real world lessons learned type of input.

Thanks for your time.

[cpenkert]

Is anyone able to offer input on my question???

[cpenkert]

anyone? Bueller?

[stephanbuys]

We always enable the "SplunkLightForwarder" app and have not seen any issues with it in production.

[cpenkert]

Thanks - we are using the SplunkForwarder so any LightForwarder benefits won't apply to us.