I have an implementation with Splunk cloud, as you know with this implementation in the cloud it would be the search head and the indexing and it would not have any type of management other than the UI
In the user's network all log sources (syslog, windows, linux, aws, database) arrive at a Heavy forwarder to be forwarded to splunk cloud
There is a delay in the arrival of the logs but it only happens in one of the sources and it is from a WAF that is in an AWS server, the rest of the sources, linux, windows, database, arrive without delay.
The logs that arrive from the WAF are stored in the HF using rsyslog and these logs arrive at the HF without delay.
The problem is between the HF and Splunk cloud.
It is not queuing because all the sources would be slow, but in this case only 1 of the sources is the one with delay.
