Splunk 2 Splunk SSL Persistent Queues

[ephemeric]

Am I just missing something or being stupid or are there no persistent queues when using Splunk2Splunk with SSL?

I see indexer acknowledgement in 4.2.1 but how does one protect against loss of in flight data over SSL and how does one (if possible) spool to disk if the intermediate forwarder or indexer are down?

[ephemeric · Accepted solution]

http://splunk-base.splunk.com/answers/1437/i-want-to-configure-usepersistentqueue-so-splunk-will-buf...

[ephemeric]

As per the docs this is not supported in this configuration.