Hi,
We are using a Splunk forwarder to forward events to Splunk indexer/Server. This is what we are doing:
1. Create a socket connection to Splunk forwarder. Connect to the socket. Write to the socket through a stream and close the socket. Next time create a new socket to connect to the forwarder.
2. The above way pushes the events and shows up immediately on the Splunk side.
Since creating and destroying is not useful, we tried implementing a socket pool to maintain the connection in the pool and reuse it.
What we observed with this is that the events written to the socket from the pool (to the forwarder) doesn't show up in the Splunk server immediately. We are not even sure if would show up eventually.
* Is there some buffering configuration on the forwarder side ?
* Also is there a standard SDK/api types (TCPInput seems like for indexers on the server side) that could used to push events to the forwarder ?
Thanks!
