Hey I have Mange to fix it, I had the port 9999 in use for universal forwarder, and after changing DB Connect task service port It worked fine. ... View more

Best practice is to collect syslog data using a syslog daemon like rsyslog or syslog-ng, which writes the logs to files (e.g. into separate folders split by source device hostname) and then use a Splunk UF to monitor those files. One of the reasons for this approach being recommended is exactly what you are after: buffering. The syslog daemon will keep writing to the files, even if the UF can no longer forward the data to the indexers. The UF will continue once connection has been restored. Check also some of the excellent sessions from last year's ,conf event that present several tips and tricks on this topic: http://conf.splunk.com/sessions/2017-sessions.html#search=syslog& ... View more