Hi, currently have a client with a gap of 2 hours in their data ingestion due to patching of their core components, likely stopping ingestion all together during the patching period. They have a heavy forwarder (which was down) that receives the inputs from the forwarders, 9 in question. Wondering what's the best form of action to aid them in filling the gap, and minimizing he damage done. ... View more