We have been using WEF as our collection point for a while. We started out small but have expanded the range of events over time. We have ~5,000 hosts forwarding to a single collector.
The collector is busy, but seems to be healthy based on conventional Windows indicators.
However, we have some data loss between the centralized event and Splunk (cloud). Logs show up in the WEF collection log but never make it to the index.
First, are there any performance tuning suggestions you can offer UF on a WEF collector?
Second, can you think of any way to check on processing of a single event once it goes into the UF and heads to the indexer?
