Hi,
We're thinking about using HEC (either Serilog Sink or Splunk SDK .Net) to log from an API, insted of developing log files and using a Universal Forwarder.
But we're highly dependant on that no data is dropped, i.e. if the HEC endpoint is unreachable for some time the solution need to buffer/cache data for the time period, and I can't seem to find any mentions about HEC buffering anywhere in the docs
So my question is does HEC offer buffering/cache capability? And in such case, how is that implemented?
hey thilleso,
You can check for this parameter
persistentQueueSize = [KB|MB|GB|TB]
Reference :
http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues
Hope this helps!!