Getting Data In

Is there a potential data loss with UDP?

ddrillic
Ultra Champion

We are forced to use UDP (and not TCP) for one client and we wonder how much data loss we might expect with UDP.

Any thoughts?

Tags (3)
0 Karma
1 Solution

dkeck
Influencer

HI,

this tuning tips might help you to lower the potential data loss.

https://wiki.splunk.com/Community:UDPInputs

View solution in original post

ddrillic
Ultra Champion

Our Sales Engineer said -

-- The best practice (not just for Splunk, really for the whole industry) is to put your UDP receiver as close as possible to the sender. Like, on the same switch if you can help it. This will minimize the lost packets that are indeed inevitable with UDP.

The other thing you should look into is whether UDP is really required. Most appliances / switches / firewalls / routers these days have an alternative way to send data. Usually an API, TCP bound syslog, a form of reliable/resilient UDP etc. Literally anything is better than basic UDP.

0 Karma

dkeck
Influencer

HI,

this tuning tips might help you to lower the potential data loss.

https://wiki.splunk.com/Community:UDPInputs

ddrillic
Ultra Champion

Thank you @dkeck!

0 Karma

nswondem
Path Finder

By definition, UDP is not reliable. Try the tuning but remember that on the network layer UDP is not going to try. No handshake.

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...