Getting Data In
Highlighted

What does the heartbeatFrequency setting do in outputs.conf?

Communicator

What does it actually mean and what are its use cases? Is this different from autoLfrequency?
From Docs, I can infer that if sendCookedData=true, then it should be enabled. What is the relation between them?

Does it do something to detect lost forwarder connection to indexer?

Thanks in advance.

Tags (2)
0 Karma
Highlighted

Re: What does the heartbeatFrequency setting do in outputs.conf?

Splunk Employee
Splunk Employee

in reference to the outputs.conf spec file http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Outputsconf

heartbeatFrequency = <integer>
* How often (in seconds) to send a heartbeat packet to the receiving server.
* Heartbeats are only sent if sendCookedData=true.
* Defaults to 30 (seconds).

It is a mechanism for the forwarder to to know that the receiver (ie indexer) is alive. If the indexer does not send a return packet to the forwarder, the forwarder will declare this receiver unreachable and not forward data to it. By default a packet is sent every 30s.

View solution in original post

Highlighted

Re: What does the heartbeatFrequency setting do in outputs.conf?

Motivator

@rphillips_splunk What port on the forwarder does the indexer send this return packet to?

0 Karma