topic What is the default compression method in the outputs.conf file in Getting Data In

What is the default compression method in the outputs.conf file

legaldan — Tue, 05 Sep 2023 08:41:40 GMT

In outputs.conf you can configure compressed = <boolean> to compress the data, but the documentation doesn't specify how the compression is done。

There is also no parameter specifying the compression method.

So my question is what compression is used by default, and whether there is any documentation on it to show that

Re: What is the default compression method in the outputs.conf file

richgalloway — Tue, 05 Sep 2023 17:10:43 GMT

Just like the Splunk protocol is undocumented, so too is the compression method. It may be a standard compression method or it may be proprietary like the protocol itself.

Splunk recommends using the compression available in SSL.

Re: What is the default compression method in the outputs.conf file

Manojbh_splunk — Tue, 05 Sep 2023 21:12:38 GMT

TCP has it's own compression standards same is applied here.