I have a multi-site indexer clustering.
All my UF(s) are configured for Site0 (auto-balanced across all indexers available in both sites) and Indexer Acknowledgement is DISABLED.
When UF tries to forward data to a specific indexer and if it is down, does UF re-try sending the SAME data to the next indexer available in the auto-load balancing list?
PS: I referred this document already and it is not clear enough about this specific situation -
http://docs.splunk.com/Documentation/Splunk/6.4.4/Forwarding/Protectagainstlossofin-flightdata
↧