Consider an environment using intermediate Forwarders as described in http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Protectagainstlossofin-flightdata#When_the_receiver_is_a_forwarder.2C_not_an_indexer
In this environment, the last Forwarder sends data to a third-party system only, as described in http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd
[Source] >>>>> [Forwarder 1] >>>>> [Forwarder 2] >>>>> [Non-Splunk]
We want to ensure that all data that arrives at Forwarder 1 is successfully received by Forwarder 2.
If we enable Indexer Acknowledgement, will Forwarder 2 send acknowledgements as soon as it has sent the data to the non-Splunk receiver? Or is this only possible if Forwarder 2 is sending data to a Splunk Enterprise Indexer?
Thanks in advance
Dave
... View more