We have run into a few cases over the last year where our index server is unavailable (either disk is full or offline for maintenance). During that time, we see the SplunkForwarder on our Windows 2008 servers consume 1-2 entire CPU's at 100% each.
Understanding that one solution (that I won't get money approved to do) would be to have redundancy at the indexer level....
I'm looking for tips on Forwarder configurations (I'm guessing via outpus.conf) that will minimize the performance impact on the Forwarding machine in the case that the indexer is unavailable. I've read some things in the documentation, but I'm hoping for some more real world lessons learned type of input.
Thanks for your time.