Deployment Architecture

Can a built-in fowarder without configuration options (useAck) connect to a Splunk indexer cluster that uses "useAck"?

gbowden_pheaa
Path Finder

We are trying to connect a Mobileiron built-in Splunk forwarder to an indexer cluster. At best we get an intermittent connection. Whenever we recycle the Mobileiron splunk daemon we see the following message from an indexer:

timestamp INFO TcpInputProc - clustering is enabled but ACK not enabled on forwarder=ip_address

We do not get any other messages after this.

Shouldn't an indexer accept a connection whether useAck is loaded or not from a forwarder? Are there any indexer configurations to accept useAck=false (default)?

0 Karma

schandrasekar
Loves-to-Learn

Hi, I am looking at how to integrate MobileIron Core data to Splunk HFs or Splunk Index cluster. Any leads, please?

0 Karma

Masa
Splunk Employee
Splunk Employee

"""
Shouldn't an indexer accept a connection whether useAck is loaded or not from a forwarder?
Are there any indexer configurations to accept useAck=false (default)?
"""
Yes, Indexer Clustering can accept default (useAck=false) settings. The message is INFO level and not indicating any connection issue.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...