Monitoring Splunk

Need advice about missing Forwarders in Splunk. What planning or DR measures do I take to make sure data is not lost?

SamHTexas
Builder

We have Network outages at times that make the FWs not available. I know that data can get quede up. But what if the outages is long & what does one do to make sure the SOC & IR have the latest data & events to work with? 

Labels (1)
Tags (1)
0 Karma

impurush
Contributor

Hi @SamHTexas,

As per my knowledge, if the data is from the file, then you no need to worry about the queue, Splunk will read from where it stopped. However, if the data is not from the file and it is generated data, then you need to increase the queue size to make the storage available to catch all the data during the forwarder offline.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...