Is Splunk logging synchronous or asynchronous?

[pankajja]

In brief, I meant to ask or understand, whenever the logs are getting pushed to splunk instance from any source (say for ex: a remote machine having universal forwarder installed and being to push forward the data to splunk instance) , these logging is synchronous i.e. until a response is returned by the API, your application will not execute any further or asynchronous i.e. calls do not block (or wait) for the API call to return from the server. Execution continues on in your program.

[pramit46]

I am not sure what you mean by logging, but as far as forwarding is concerned, you can make it synchronized by changing the value of useACK to true. Additionally, you can also set values against the field readTimeout in order to specify how long the fwdr should wait for indexer response.

[FrankVl]

Indeed, the interface between a Forwarder and an Indexer (which is just one of the many interfaces in a distributed Splunk environment) is a-synchronous by default and becomes somewhat synchronous when acknowledgements are enabled: https://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/Protectagainstthelossofin-flightdata

I say somewhat synchronous, because it doesn't wait for an ack after each individual transmission before sending the next chunk of data. It uses in memory queues to be able to keep sending new data while waiting for acknowledgements of previously transmitted data.

[mayurr98]

hey @pankajja

As long as I understand, whenever the logs are getting pushed to Splunk instance from any source via UF the indexer will continue to index the data as long as a connection is established if there is a connection loss between the indexer and UF, then indexer will not index anything. Once the connection is up, the indexer will continue to index from where it stopped in case of monitored file input and you will lose the data in that time period if you are using a port monitor.

let me know if this helps!