Impact of indexer going down for sometime.

[Satyams14]

Hello All,

We have a server on which indexer and search head deployed. furthermore we are getting logs from UF and HF's. due to some requirement we might require some downtime for the server on which Indexer and search head has been deployed.

Will there be any log loss due to this server downtime? If yes how long logs will be lost there?

If UF cache logs locally then for how log UF cache the logs, if there any dependency on cache memory available on UF server?

[Satyams14]

Hello ,

Thanks for your response, i would like to understand how would stopping UF and HF will prevent log loss?

Waiting for your response.

Regards,

Satyam

[glc_slash_it]

Obviously it depends on the types of logs you are monitoring:

- if its static files, UF/HF will save a checkpoint of where they stop reading, and will continue whenever you start them again

- if is tcp/udp or syslog-like, you need to adopt other strategies like setting up a distributed Splunk environment with a cluster of Indexers or a Syslog server to receive the tcp/udp logs and write them to files.

[glc_slash_it]

Hi,

The best way to avoid logs being lost would be to stop the UFs and HFs  before taking down the Indexers.

Another way woulbe be to disable the inputs.conf, by creating/updating a configuration like this:

[perfmon:*]
disabled = true

[WinEventLog:] 
disabled = true

[monitor://<path>]
disabled = true

------------
If this was helpful, some karma would be appreciated.