Hi,
We're thinking about using HEC (either [Serilog Sink][1] or [Splunk SDK .Net][2]) to log from an API, insted of developing log files and using a Universal Forwarder.
But we're highly dependant on that no data is dropped, i.e. if the HEC endpoint is unreachable for some time the solution need to buffer/cache data for the time period, and I can't seem to find any mentions about HEC buffering anywhere in the docs
So my question is does HEC offer buffering/cache capability? And in such case, how is that implemented?
[1]: https://github.com/serilog/serilog-sinks-splunk
[2]: http://dev.splunk.com/view/splunk-loglib-dotnet/SP-CAAAEX4
↧