Getting Data In

What can be the effects of rebooting a server without taking the forwarder down cleanly?

danielbb
Motivator

Many of the forwarders here go down when the servers go for maintenance work. What can go wrong with the forwarders when we don't shut them down cleanly?

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

I think the main thing that can happen is that they wont start up properly.
other then that, if you have scripted inputs, the scripts wont run, for monitor data, you will resume to (or close) the point where the forwarder stopped.
if its using as an aggregation, meaning. intermediate forwarder, then youll probably lose data

View solution in original post

adonio
Ultra Champion

I think the main thing that can happen is that they wont start up properly.
other then that, if you have scripted inputs, the scripts wont run, for monitor data, you will resume to (or close) the point where the forwarder stopped.
if its using as an aggregation, meaning. intermediate forwarder, then youll probably lose data

Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...