Splunk Enterprise

Setting useACK in outputs.conf in a Distributed Environment (Universal Forwarder + Heavy Forwarder + Indexer)

edoardo_vicendo
Contributor

Hello,

In a distributed environment with Universal Forwarder, Heavy Forwarder and Indexers, like this one:

UF --> HF --> IDX

How do you set useACK=true in outputs.conf ?

Is it needed to be enabled both on Universal Forwarder and Heavy Forwarder?

We currently have it enabled only on the Heavy Forwarder.

Thanks a lot,

Edoardo

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

As I understand it, the instance with useACK=true will buffer packets until they are acknowledged by the indexer.  If useACK=false then the packet is discarded once it is sent.  (These are Splunk packets, not TCP packets.)  Also, useACK adds a kind of flow control to the data stream.  For better end-to-end control, use useACK=true on the UF and HF.  Note that this will force the instance to use more memory.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

As I understand it, the instance with useACK=true will buffer packets until they are acknowledged by the indexer.  If useACK=false then the packet is discarded once it is sent.  (These are Splunk packets, not TCP packets.)  Also, useACK adds a kind of flow control to the data stream.  For better end-to-end control, use useACK=true on the UF and HF.  Note that this will force the instance to use more memory.

---
If this reply helps you, Karma would be appreciated.

edoardo_vicendo
Contributor
0 Karma
Get Updates on the Splunk Community!

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...