Getting Data In

what if indexer is unavailable when using DNS list load balancing

saifuddin9122
Path Finder

a universal forwarder will request to resolve XXXXXX (DNS) and it may get an IP address of the indexer that is no longer available
in that case, it doesn’t have another address to try, so what will it do 

0 Karma

dshpritz
SplunkTrust
SplunkTrust

You should check out the Protect against loss of in-flight data section of the forwarding manual, as well as the Persistent Queues section of the Getting Data In manual. TL;DR: For some inputs, Splunk has a configurable queue where it will store data for when forwarding can resume. For other types of inputs, it will stop following the input until the pipeline is clear again.

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...