Splunk stops logging windows events after temporarily loosing network connection

[stefan1988]

I'm monitoring Sysmon events from my laptop, but if I temporarily lose network connection Splunk stops logging completely while _internal logging resumes.

Is there an option in inputs.conf to force splunk to always read WinEventLog://Microsoft-Windows-Sysmon/Operational, even after a network hickup?

[woodcock]

Assuming that this is an all-in-one architecture running on your laptop then if you ever have blocked queues, you may find that your Indexers suddenly refuse to receive data from forwarders requiring the whole Indexer to be rebooted (does not happen on Linux Indexers):

https://docs.splunk.com/Documentation/Splunk/6.6.0/Forwarding/Receiverconnection#Receiver_does_not_a...
Try the workaround in the link.

[nit123]

You can have a retry mechanism if you encounter a network failure for 'X' amount of duration.