I have service now add on, db connect in Heavy Forwarder. So i cant use multiple instances of HF to avoid data duplication and licensing. My both apps Service Now and DB connect are in real time sync, also I need to do changes in props & transforms frequently. so in this case how to avoid data loss. Just using indexer ack will resolve?
To better understand your situation: why do you have frequent props/transforms changes that require a restart? Does this HF do other tasks, besides the SN and DBX apps (e.g. routing data from other forwarders or so)?
Since I am also expecting an answer to a similar question, please find the details below.
When we add a new HEC via inputs.conf in HF, we have a setting restartSplunkd = true in Serverclass associated with HEC app. So whenever we add a new HEC, we need to restart the HF's that is used to collect the HTTP inputs.
Can we use restartSplunkd = false while adding a new inputs.conf ?