Quantcast
Channel: Questions in topic: "heavy-forwarder"
Viewing all articles
Browse latest Browse all 727

Queue size for splunktcp - Data Loss on HF

$
0
0
Hi Ninjas I wonder how we lost data on the following scenario: Universal Forwarders sending their Data to a central Heavy Forwarder - this Heavy Forwarder uses Indexer ACK . However, due to a missconfiguration, the HF was not able to reach the indexer for a couple of hours. Getting rid of the wrong config, the output works fine again but i dont see data from the universal forwarders which has been produced during the downtime of the HF - in my understanding, using ack should prevent from that as long the queue is not filled up but then should stop its service totally. The docs here are not that verbose and I wonder where my data was lost. It has to be said that i dont know how the ufs are configured - and not able to check that as they are provided by an external party. Any ideas what happend and how i can prevent that in the future?

Viewing all articles
Browse latest Browse all 727

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>