Hello, Can you please elaborate about the Forwarder/Indexer communication? As I understand the communication is realized via TCP using some Splunk proprietary mechanism. I’d like to understand what will happen if the Forwarder will lose the connectivity with the Indexer. How will the forwarder’s host will behave on some heavy load with a big log records generated, including the situation when the Indexer is unexpectedly unreachable, like i.e. all the packets from the Forwarder will be dropped on the Indexer. Will the communication reestablish automatically when the Indexer will become reachable again? Am curious if such tests where done and what are the results. Thanks, Iurie ... View more