question

kadeti7307 avatar image
kadeti7307 asked

What are the benefits of feeding data into a Splunk instance through Splunk Forwarders?

If you transfer the data into a Splunk instance through Splunk Forwarders, you'll enjoy three benefits: TCP connection and bandwidth throttling. The security of an SSL connection for transferring information from the Forwarder to an Indexer. Splunk's design is such that the data sent onto the Indexer is automatically balanced.

Suppose one Indexer is shut down for reasons beyond its control. The data will be redirected to another Indexer instance very quickly. In addition, Splunk Forwarders cache the events locally before sending them and creates an interim backup of the information.


dataflow
10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

0 Answers

·

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.