Knowledge Management

Is Splunk logging synchronous or asynchronous?

pankajja
New Member

In brief, I meant to ask or understand, whenever the logs are getting pushed to splunk instance from any source (say for ex: a remote machine having universal forwarder installed and being to push forward the data to splunk instance) , these logging is synchronous i.e. until a response is returned by the API, your application will not execute any further or asynchronous i.e. calls do not block (or wait) for the API call to return from the server. Execution continues on in your program.

Tags (1)
0 Karma

pramit46
Contributor

I am not sure what you mean by logging, but as far as forwarding is concerned, you can make it synchronized by changing the value of useACK to true. Additionally, you can also set values against the field readTimeout in order to specify how long the fwdr should wait for indexer response.

0 Karma

FrankVl
Ultra Champion

Indeed, the interface between a Forwarder and an Indexer (which is just one of the many interfaces in a distributed Splunk environment) is a-synchronous by default and becomes somewhat synchronous when acknowledgements are enabled: https://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/Protectagainstthelossofin-flightdata

I say somewhat synchronous, because it doesn't wait for an ack after each individual transmission before sending the next chunk of data. It uses in memory queues to be able to keep sending new data while waiting for acknowledgements of previously transmitted data.

0 Karma

mayurr98
Super Champion

hey @pankajja

As long as I understand, whenever the logs are getting pushed to Splunk instance from any source via UF the indexer will continue to index the data as long as a connection is established if there is a connection loss between the indexer and UF, then indexer will not index anything. Once the connection is up, the indexer will continue to index from where it stopped in case of monitored file input and you will lose the data in that time period if you are using a port monitor.

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...