Getting Data In

what if indexer is unavailable when using DNS list load balancing

saifuddin9122
Path Finder

a universal forwarder will request to resolve XXXXXX (DNS) and it may get an IP address of the indexer that is no longer available
in that case, it doesn’t have another address to try, so what will it do 

0 Karma

dshpritz
SplunkTrust
SplunkTrust

You should check out the Protect against loss of in-flight data section of the forwarding manual, as well as the Persistent Queues section of the Getting Data In manual. TL;DR: For some inputs, Splunk has a configurable queue where it will store data for when forwarding can resume. For other types of inputs, it will stop following the input until the pipeline is clear again.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...