How logging from different sources works when there is network outage?

[akasmika]

Hi Splunkers,

I would like to know what happens to logging in below scenarios when there is an outage. I would like to know if splunk restores logging when the systems are back from outage or does it lose the logs.

1. logs are getting forwarded from an app

2.  synced from an S3 bucket

3. pulled via API

4. data coming through heavy forwarder

Thanks

[PickleRick]

It all depends on the particular mechanism of transporting logs from the source to the forwarder.

In general, the forwarder has a configurable buffer in which it stores events destined for the indexer(s) or upstream forwarder.

But whether data will get "filled" is up to the input. If it's a simple sylog input, especially UDP one, the source will most probably not retransmit the events. If it's a scripted/modular input, it's up to the script's author (but usually the input is able to "catch up").

It also depends on the duration of the outage because even if the input is in theory able to catch up but the data gets removed (rotated out) from the source, you will have gaps.