Setting useACK in outputs.conf in a Distributed Environment (Universal Forwarder + Heavy Forwarder + Indexer)

[edoardo_vicendo]

Hello,

In a distributed environment with Universal Forwarder, Heavy Forwarder and Indexers, like this one:

UF --> HF --> IDX

How do you set useACK=true in outputs.conf ?

Is it needed to be enabled both on Universal Forwarder and Heavy Forwarder?

We currently have it enabled only on the Heavy Forwarder.

Thanks a lot,

Edoardo

[richgalloway · Accepted solution]

As I understand it, the instance with useACK=true will buffer packets until they are acknowledged by the indexer.  If useACK=false then the packet is discarded once it is sent.  (These are Splunk packets, not TCP packets.)  Also, useACK adds a kind of flow control to the data stream.  For better end-to-end control, use useACK=true on the UF and HF.  Note that this will force the instance to use more memory.

[edoardo_vicendo]

Thank you, is well described here:

https://docs.splunk.com/Documentation/Forwarder/8.2.0/Forwarder/Protectagainstthelossofin-flightdata...