Deployment Architecture

If the receiver is down, would the data from the Universal Forwarder be lost?


If the receiving Splunk is down for some time, would Universal Forwarder keep sending and the data would be lost or it wouldn't be?

Thank you.

Tags (1)


What do you mean by Splunk? I believe are you referring to the Splunk Indexers, the answer is maybe. This all depends on your input.

If you are monitoring files the answer is no since the UF will pick up where it left off last. Though that does not protect against in-flight data loss. You can protect against in-flight data lost by using indexer acknowledgment.

If you data is streamed such as raw TCP data or Syslog data, yes you could lose data. There are ways to help protect against that. By using indexer acknowledgement and increasing queueSize on both your input.conf and output.conf files.

If you have multiple indexer you can use the UFs built in Auto Load Balancing feature.

Here is a good post on HA: splunk-disaster-recovery

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...