https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Data/Usepersistentqueues
Persistent queuing is available for certain types of inputs, but not all.
One major limitation with persistent queue at inputs enabled on certain UF/HF/IHF/IUF inputs, if downstream parsingqueue/indexqueue/tcpoutqueue are blocked/saturated and a DS bundle push triggers splunk restart, events will be dropped if UF/HF/IHF/IUF failed to drain queues.
On windows DC, persistent queuing is enabled for windows modular inputs, DS bundle push triggers DC restart and events in parsingqueue/tcpoutqueue will be dropped.
On windows DC, some windows event (event occurred while the workstation was being shut down ) logs are always lost.
When Laptops are off the network and restarted/shutdown, in-memory queue events are dropped.
With PQ, during splunk restart on forwarding tier, still splunk in-memory queued events might get dropped.
