If you have a heavy forwarder (not working in UF or LWF) with the syslog forwarding configured.
It will send the matching events as syslog at the same step it would : forward to other splunk, write to disk in a local index.
So if any queues are full (splunk indexer not accessible, local index full, or syslog server not responding), then it will pause the whole indexing process on all channels, once the queues are full. As for regular splunk forwarding.
So If you were receiving non persistent data (like UDP/TCP), I would recommend to use a file buffer before the forwarder. By example monitor a log file on disk, or use persistent queues.
... View more