Getting Data In

what if indexer is unavailable when using DNS list load balancing

saifuddin9122
Path Finder

a universal forwarder will request to resolve XXXXXX (DNS) and it may get an IP address of the indexer that is no longer available
in that case, it doesn’t have another address to try, so what will it do 

0 Karma

dshpritz
SplunkTrust
SplunkTrust

You should check out the Protect against loss of in-flight data section of the forwarding manual, as well as the Persistent Queues section of the Getting Data In manual. TL;DR: For some inputs, Splunk has a configurable queue where it will store data for when forwarding can resume. For other types of inputs, it will stop following the input until the pipeline is clear again.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...