Getting Data In

Splunk Universal Forwarder Connection to Indexer

ezajac
Path Finder

How does the Splunk Universal Forwarder handle the condition when SPLUNK TCP is used as the communication method and the Splunk Indexer is down? (maintenance, someone disconnects the server, ...)

0 Karma

ChrisG
Splunk Employee
Splunk Employee

As bmacias84 mentions in the other post, if your indexer is down you will lose data, but with a forwarder you can enable the indexer acknowledgement feature. See Protect against loss of in-flight data in the Distributed Deployment Manual.

bmacias84
Champion

@ezajac, It depend on your input and your configuration. Here are a couple of post that already cover HA with links to additional read material.

if-the-receiver-is-down-would-the-data-from-the-universal-forwarder-be-lost
splunk-disaster-recovery?

Hope this helps. Cheers.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!