Splunk logs are missing in flight. about firehose-to-syslog HOT 4 CLOSED

Hi,
First which nozzle are you using ?? Splunk-to-syslog of Firehose-to-syslog ?

Splunk-to-syslog used to be similar to f2s but they diverge 2 years ago..

About your error most of the time this come from the ingestor. Meaning Splunk could not ingest the logs fast enough so f2f buffer until buffer are full.

Btw should be 5 nozzle as you have 5TC, but just to be sure you don't have any perf issue I will increase the number of nozzle, like 7-8.

I will advise you to check how much your splunk endpoint can ingest.

Thanks

from firehose-to-syslog.

Thank you for your response, we are using F2S and that's a typo we have 5 nozzles. When you say "check how much your Splunk endpoint can ingest", are you saying F2S or Splunk product? If it is Splunk, then increasing the Nozzle instances make it worse as they will be egressing more logs.

Thanks

from firehose-to-syslog.

"If it is Splunk, then increasing the Nozzle instances make it worse as they will be egressing more logs."
Not sure to understand here ...

If you are loosing logs means that you want more logs to be ingest by splunk.

Buffering logs in F2S is limited.

from firehose-to-syslog.

Thanks Gwenn, you can close this thread.

from firehose-to-syslog.