I have tried two input modes: monitor and tcp. When I use the monitor mode and read text files, the data sending from the Universal Forwarder resumes in case the network connectivity gets lost.
However, when I use tcp as an input and a persistent queue, I see that the queue grows while there is no connectivity (for example, if I turn wifi off). When turning the connection on again, the persistent queue remains growing and no data is actually sent to the server.
I have to restart Splunk so that the sending resumes. The restarting takes a few minutes - not the case with the monitor mode - and when it finally restarts, the persistent queue is erased and the data that was saved there doesn't get sent.
Is there a major bug with the universal forwarder?
