Getting Data In

Splunk Universal Forwarder Connection to Indexer

ezajac
Path Finder

How does the Splunk Universal Forwarder handle the condition when SPLUNK TCP is used as the communication method and the Splunk Indexer is down? (maintenance, someone disconnects the server, ...)

0 Karma

ChrisG
Splunk Employee
Splunk Employee

As bmacias84 mentions in the other post, if your indexer is down you will lose data, but with a forwarder you can enable the indexer acknowledgement feature. See Protect against loss of in-flight data in the Distributed Deployment Manual.

bmacias84
Champion

@ezajac, It depend on your input and your configuration. Here are a couple of post that already cover HA with links to additional read material.

if-the-receiver-is-down-would-the-data-from-the-universal-forwarder-be-lost
splunk-disaster-recovery?

Hope this helps. Cheers.

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...