Getting Data In

What does the heartbeatFrequency setting do in outputs.conf?

splunkn
Communicator

What does it actually mean and what are its use cases? Is this different from autoLfrequency?
From Docs, I can infer that if sendCookedData=true, then it should be enabled. What is the relation between them?

Does it do something to detect lost forwarder connection to indexer?

Thanks in advance.

Tags (2)
0 Karma
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

in reference to the outputs.conf spec file http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Outputsconf

heartbeatFrequency = <integer>
* How often (in seconds) to send a heartbeat packet to the receiving server.
* Heartbeats are only sent if sendCookedData=true.
* Defaults to 30 (seconds).

It is a mechanism for the forwarder to to know that the receiver (ie indexer) is alive. If the indexer does not send a return packet to the forwarder, the forwarder will declare this receiver unreachable and not forward data to it. By default a packet is sent every 30s.

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

in reference to the outputs.conf spec file http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Outputsconf

heartbeatFrequency = <integer>
* How often (in seconds) to send a heartbeat packet to the receiving server.
* Heartbeats are only sent if sendCookedData=true.
* Defaults to 30 (seconds).

It is a mechanism for the forwarder to to know that the receiver (ie indexer) is alive. If the indexer does not send a return packet to the forwarder, the forwarder will declare this receiver unreachable and not forward data to it. By default a packet is sent every 30s.

wrangler2x
Motivator

@rphillips_splunk What port on the forwarder does the indexer send this return packet to?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...