If indexers cannot be reached while working with network inputs, where is data stored?

When indexers cannot be reached while working with network inputs, data is primarily stored in the output queue. The output queue serves as a temporary storage location for the data that is ready to be sent to the indexers but cannot be delivered due to connectivity issues or other interruptions in the indexing pipeline.

This queuing system is crucial because it ensures that no data is lost during these interruptions. The output queue collects and holds the data until the connection to the indexers is restored, at which point the data can be sent on for indexing. Keeping data in such a queue allows Splunk to maintain data integrity and ensures that all events are eventually processed and made searchable.

In contrast, the memory queue is a transient storage mechanism that holds data in memory before it is sent to the output queue and eventually to the indexers. The persistent queue stores data on disk for guaranteed delivery when there are heavy loads or if the output queue has reached its limits. The error queue is used to capture data that cannot be processed due to format or parsing errors, which is separate from the scenario presented in the question. Thus, the output queue is the correct choice for understanding where data is temporarily held when indexers are unreachable.