Getting Data In

Splunk Universal Forwarder Connection to Indexer

ezajac
Path Finder

How does the Splunk Universal Forwarder handle the condition when SPLUNK TCP is used as the communication method and the Splunk Indexer is down? (maintenance, someone disconnects the server, ...)

0 Karma

ChrisG
Splunk Employee
Splunk Employee

As bmacias84 mentions in the other post, if your indexer is down you will lose data, but with a forwarder you can enable the indexer acknowledgement feature. See Protect against loss of in-flight data in the Distributed Deployment Manual.

bmacias84
Champion

@ezajac, It depend on your input and your configuration. Here are a couple of post that already cover HA with links to additional read material.

if-the-receiver-is-down-would-the-data-from-the-universal-forwarder-be-lost
splunk-disaster-recovery?

Hope this helps. Cheers.

Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...