Getting Data In

Will Heavy Forwarder buffer logs, when sending to syslog-out?


Hey Guys,

I set up a Heavy Forwarder atm and just asking myself if a heavy forwarder will buffer the local logs when sent via the syslog-output in the outputs.conf. My config look like this:


defaultGroup = Target-IP,Target-IP2

indexAndForward = 0


[syslog:Target-IP of Indexer]

server = Target-IP of Indexer


Regarded to the Outputs.conf manual of Splunk there is no option to enable active buffering when using syslog-output

If now the Indexer goes down, will the HF buffer the logs on the local disk and send to it when online again, or will they be dropped?

Thanks for response

0 Karma

Path Finder

You should only be using syslog outputs when sending to a non-Splunk server. If you're going to a Splunk indexer, use a configuration more like:


defaultGroup = output_fwd


server =

useACK = true

syslog-udp will definitely lose data, and syslog-tcp will probably lose the last few messages before the TCP session closes (because it's impossible for Splunk to know what has actually been received), and then buffer it until a new TCP session is established.

0 Karma

New Member


thanks for response, but unfortunately the indexer i send the data to, is a non-Splunk indexer. Are there still possibilities to cache/buffer the data?

But given to your answer, whats the difference between "syslog-out" and "tcp:out"?(I configured it via a manual from the third-party system, so i acutally dont know it 😄 )

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!