What does the heartbeatFrequency setting do in outputs.conf?

[splunkn]

What does it actually mean and what are its use cases? Is this different from autoLfrequency?
From Docs, I can infer that if sendCookedData=true, then it should be enabled. What is the relation between them?

Does it do something to detect lost forwarder connection to indexer?

Thanks in advance.

[rphillips_splk · Accepted solution]

in reference to the outputs.conf spec file http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Outputsconf

heartbeatFrequency = <integer>
* How often (in seconds) to send a heartbeat packet to the receiving server.
* Heartbeats are only sent if sendCookedData=true.
* Defaults to 30 (seconds).

It is a mechanism for the forwarder to to know that the receiver (ie indexer) is alive. If the indexer does not send a return packet to the forwarder, the forwarder will declare this receiver unreachable and not forward data to it. By default a packet is sent every 30s.

[wrangler2x]

@rphillips_splunk What port on the forwarder does the indexer send this return packet to?