Forums: SplunkGeneral: Splunk forwarders and priority

If an indexing host becomes overloaded due to more data than it can handle being sent to it and the forwarders starti buffering their cooked data locally, does Splunk use a priority system once the indexers becomes available again?
I.e. does older buffered data take precedence over any new data that might be sent to Splunk or is there no such system and we should assume that the older buffered data is indexed like any other data?

At the present time, the scenario you described will result in the data being indexed on a first-come, first-served basis when the indexer becomes available again. We have identified this as suboptimal for several reasons, and thus several enhancement requests have been submitted to create a queuing and throttling device between forwarders and receivers. This is not yet in the road map, so I can't give you a date or version at this time.

It is interesting to know, all the same. Thanks. Indeed, some form of prioritization would be interesting in our environment (where people need real-time performance and access to their logs as quickly as possible).