Hello community,
I would like to ask you something, and I'm hoping that you can help me with this.
I'm sending data from one universal forwarder to 2 environments (1 Stand Alone and 1 Cluster).
For some reason, when i have 100 events on Stand Alone with this time window (earliest=-3m@m latest=-m@m) on the cluster, I have only 80 and only some minutes after i get 100 events on cluster.
Why can this be happening? The source types are the same and i wasn't able to find some error on internal.
Thanks you for your time and i hope you can help me.
Greetings.
... View more