Getting Data In

Heavy Forwarder stopped sending data

3DGjos
Communicator

Hello,

Let's say we have Heavy Forwarder forwarding logs to groups A (Which consists of two IDX) and group B (One HF). Group B does not make LB, group A does.

My question is, what will the Heavy Forwarder do with the data if group A losses connectivity? Does the HF keep sending data to group B?

Thanks in advance.

horaciob
Explorer

To clarify the query:
What happens in Splunk if there are two data sending groups (duplicating the information). If one of those groups (receiving Server) stops attending and quarantines the forwarder?
Stop sending data to the other group too?
Thank you

0 Karma

skalliger
SplunkTrust
SplunkTrust

You mean what happens when the Heavy Forwarder stops sending data to your indexers? Heavy Forwarders are able to buffer the data, depending on your configuration just like Universal Forwarders. When the connection is restored, the events will be sent to the indexers again. This works only with "useACK" enabled. You may need to adjust the settings on maxQueueSize though if you're expecting outages to happen.
Take a look at the outputs.conf documentation.

Skalli

0 Karma

3DGjos
Communicator

Sorry, I wasn't clear in my first post. I mean, I want to know what happens if one of the groups, in my example group A, is quarantined due to connection lost or any other problem. In the example the HF is unable to send data to group A and puts it on quarantine. My question is... in this case, does the HF keeps sending the data to group B? even if it stopped sending the data to A due to quarantine? Because is my understanding that in this case it stores the data in buffer.

Thanks!

0 Karma

skalliger
SplunkTrust
SplunkTrust

Okay, now I got it.
Your heavy forwarder forwards data both to your indexers and another heavy forwarder. One question first, why would you do this?

If you define two stanzas in your outputs.conf, both sending targets will get their own output queue. So, if one target will be down, the queue will be blocked but the other target will still get the data.
Here is an example of this.

Skalli

3DGjos
Communicator

Thanks for your answer skalliger, we have inherited the implementation. I have another question, bah, it's the same question but a little more specific.

we have:

[tcpout]
defaultGroup = A, B

[tcpout:A]
server=10.1.1.200:9999, 10.1.1.201:9991

[tcpout:B]
server=10.1.2.11:9996

Both groups have different output queues, so if group A losses connection, full data is sill sent to group B, can you confirm me that?

Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...