Getting Data In

what if indexer is unavailable when using DNS list load balancing

saifuddin9122
Path Finder

a universal forwarder will request to resolve XXXXXX (DNS) and it may get an IP address of the indexer that is no longer available
in that case, it doesn’t have another address to try, so what will it do 

0 Karma

dshpritz
SplunkTrust
SplunkTrust

You should check out the Protect against loss of in-flight data section of the forwarding manual, as well as the Persistent Queues section of the Getting Data In manual. TL;DR: For some inputs, Splunk has a configurable queue where it will store data for when forwarding can resume. For other types of inputs, it will stop following the input until the pipeline is clear again.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...