Peer sends acknowledgment whether fulfil replication factor when forwarder is mAck=true

[Wenjian_Zhu]

Dear splunkers,

When set useAck = true (https://docs.splunk.com/Documentation/Splunk/9.4.0/Forwarding/Protectagainstlossofin-flightdata).

The source peer sends acknowledgment after writing the data to its file system and ensuring the replication factor is met 

or

The source peer sends acknowledgment after writing the data to its file system.

Best regards,

[isoutamo · Accepted solution]

Actually it needs that replication factor has met on indexers before the ack has sent.

You should read below post and also those where are linked there.

Here is one old excellent post about it https://community.splunk.com/t5/Knowledge-Management/Splunk-Indexer-Forwarder-Acknowledgement-explai...

[Wenjian_Zhu]

Hi @isoutamo ,

Thx a lot 👍.

BR

[SanjayReddy]

Hi @Wenjian_Zhu 

 Indexer acknowledgment will be sent after data written into the disk of indexer. 

there is no relation with data replication with indexer acknowledgment

acknowledgment is to let forwarders know data has been received at the indexer end and forwarder which sent data to indexer , will remove the events from the wait queue.

also recommended to enable   acknowledgment at at intermediate forwader and indexer 

[Wenjian_Zhu]

Hi @SanjayReddy 

Thanks for the feedback, that screenshot is when receiver is a forwarder.

This is a good explanation https://community.splunk.com/t5/Knowledge-Management/Splunk-Indexer-Forwarder-Acknowledgement-explai... as @isoutamo mentioned.

Thanks.