Getting Data In

Is it best practice to use useACK in outputs.conf

ekenne06
Path Finder

I have inherited a SPlunk environment and one thing i've noticed is that one all of our heavy forwarders are using useACK.  Is this best practice? we are seeing duplicate events due to this, and I wanted to see if I should work on tailoring the config for indexer acknowledgement, or if I should just disable it and move on. 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It depends on your goals.  To prevent data loss, useACK is recommended.  Acknowledgement increases the chances of data duplication, however, so that needs to be accounted for in searches.  Choose to use useACK based on which scenario is least painful to you.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It depends on your goals.  To prevent data loss, useACK is recommended.  Acknowledgement increases the chances of data duplication, however, so that needs to be accounted for in searches.  Choose to use useACK based on which scenario is least painful to you.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...