Getting Data In

What can be the effects of rebooting a server without taking the forwarder down cleanly?

danielbb
Motivator

Many of the forwarders here go down when the servers go for maintenance work. What can go wrong with the forwarders when we don't shut them down cleanly?

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

I think the main thing that can happen is that they wont start up properly.
other then that, if you have scripted inputs, the scripts wont run, for monitor data, you will resume to (or close) the point where the forwarder stopped.
if its using as an aggregation, meaning. intermediate forwarder, then youll probably lose data

View solution in original post

adonio
Ultra Champion

I think the main thing that can happen is that they wont start up properly.
other then that, if you have scripted inputs, the scripts wont run, for monitor data, you will resume to (or close) the point where the forwarder stopped.
if its using as an aggregation, meaning. intermediate forwarder, then youll probably lose data

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...