Hi All,
sorry if this is a stupid question.
When you configure a Intermediate Heavy Forwarder(Non-Indexing) receiver.
Can you add a persistent Que within this to avoid data loss for a period the upstream indexer is unavailable?
[splunktcp://9997]
persistentQueueSize=100MB <--- ???
disabled = 0
I've seen the docs and it's mostly around UF's and types of ephemeral connections, though it doesn't stipulate wither this can be done on the receiver. Though I imagine someone will tell me there's a better way to configure this.
Thanks in advance.
↧