Editorial question36.8K views1,002 votes0 answers936 following
AI-generatedIndexing Retried Events: Avoiding Duplicate Writes in Splunk Forwarders
Problem Statement The goal is to guarantee that events sent from a Splunk forwarder are written to an index only once, even when transient network failures trigger retries. The forwarder can be configured with indexer_ack = true and a retry stanza, while the indexer may reject duplicates based on event IDs. However, it is unclear whether this combination pro
splunk