Currently failed posts to Splunk by Data Gateways/Logstash are dumped to the Dead Letter Queue and left there to accumulate. These can be resent using the Logstash API; however, this should be provided by the Data Gateways platform and represents a blindspot in the tool.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.