Event Data Buffering on Laptops (When Offline)
As explained here uberAgent stores collected data in a memory buffer until it could be sent to Splunk successfully. This protects against shorter periods without network connectivity very well. On laptops or other mobile devices that are offline for longer periods of time (several days or even weeks), however, a more robust solution is required that persists data across reboots, too.
Enable Persistent Queueing
To buffer all collected data on disk until it can be sent off to Splunk follow these steps:
- Configure uberAgent to sent data to a locally installed Splunk Universal Forwarder
- Enable the setting
persistentQueueSizeon the Universal Forwarder
Please refer to this documentation for more information.