Getting Data In

What can be the effects of rebooting a server without taking the forwarder down cleanly?

danielbb
Motivator

Many of the forwarders here go down when the servers go for maintenance work. What can go wrong with the forwarders when we don't shut them down cleanly?

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

I think the main thing that can happen is that they wont start up properly.
other then that, if you have scripted inputs, the scripts wont run, for monitor data, you will resume to (or close) the point where the forwarder stopped.
if its using as an aggregation, meaning. intermediate forwarder, then youll probably lose data

View solution in original post

adonio
Ultra Champion

I think the main thing that can happen is that they wont start up properly.
other then that, if you have scripted inputs, the scripts wont run, for monitor data, you will resume to (or close) the point where the forwarder stopped.
if its using as an aggregation, meaning. intermediate forwarder, then youll probably lose data

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...