Event Data Buffering on Laptops (When Offline)

As explained here uberAgent stores collected data in a memory buffer until it could be sent to Splunk successfully. This protects against shorter periods without network connectivity very well. On laptops or other mobile devices that are offline for longer periods of time (several days or even weeks), however, a more robust solution is required that persists data across reboots, too.

Enable Persistent Queueing

To buffer all collected data on disk until it can be sent off to Splunk follow these steps:

  • Configure uberAgent to sent data to a locally installed Splunk Universal Forwarder
  • Enable the setting persistentQueueSize on the Universal Forwarder

Please refer to this documentation for more information.

Leave a Reply

Your email address will not be published. Required fields are marked *