If the intention of using a Universal Forwarder is only for a buffer to the Indexer, is it worth having one?
Theory: Should there be a need to take the Indexer down for maintenance, the UF could continue to receive data and then catch the Indexer back up when maintenance is complete.
Is there any other method (outside of maybe Clustered Indexer) to ensure that log data continues to flow (from say 300 inputs) to somewhere while the Indexer server is down for a short period?
↧