Splunk Universal Forwarder Connection to Indexer

[ezajac]

How does the Splunk Universal Forwarder handle the condition when SPLUNK TCP is used as the communication method and the Splunk Indexer is down? (maintenance, someone disconnects the server, ...)

[ChrisG]

As bmacias84 mentions in the other post, if your indexer is down you will lose data, but with a forwarder you can enable the indexer acknowledgement feature. See Protect against loss of in-flight data in the Distributed Deployment Manual.

[bmacias84]

@ezajac, It depend on your input and your configuration. Here are a couple of post that already cover HA with links to additional read material.

if-the-receiver-is-down-would-the-data-from-the-universal-forwarder-be-lost
splunk-disaster-recovery?

Hope this helps. Cheers.