Monitoring Splunk

Need advice about missing Forwarders in Splunk. What planning or DR measures do I take to make sure data is not lost?

SamHTexas
Builder

We have Network outages at times that make the FWs not available. I know that data can get quede up. But what if the outages is long & what does one do to make sure the SOC & IR have the latest data & events to work with? 

Labels (1)
Tags (1)
0 Karma

impurush
Contributor

Hi @SamHTexas,

As per my knowledge, if the data is from the file, then you no need to worry about the queue, Splunk will read from where it stopped. However, if the data is not from the file and it is generated data, then you need to increase the queue size to make the storage available to catch all the data during the forwarder offline.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...