https://community.splunk.com/t5/Getting-Data-In/Difference-between-ParsingQueue-and-IndexQueue/m-p/102363#M21476 <P>Whats the difference between ParsingQuerue and IndexQueue and what their purpose when applied to both inputs.conf, transforms.conf and props.conf?</P> Thu, 25 Oct 2012 01:24:51 GMT Dark_Ichigo 2012-10-25T01:24:51Z https://community.splunk.com/t5/Getting-Data-In/Difference-between-ParsingQueue-and-IndexQueue/m-p/102363#M21476 <P>Whats the difference between ParsingQuerue and IndexQueue and what their purpose when applied to both inputs.conf, transforms.conf and props.conf?</P> Thu, 25 Oct 2012 01:24:51 GMT https://community.splunk.com/t5/Getting-Data-In/Difference-between-ParsingQueue-and-IndexQueue/m-p/102363#M21476 Dark_Ichigo 2012-10-25T01:24:51Z https://community.splunk.com/t5/Getting-Data-In/Difference-between-ParsingQueue-and-IndexQueue/m-p/102364#M21477 <P>One of the many differences (and perhaps most practical to address) is on what Splunk instance each configuration belongs. A practical guide on <A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F">where Splunk settings should be configured</A> is located on the <A href="http://wiki.splunk.com/">Splunk Wiki</A>. <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Datapipeline">An overview of the pipelines</A> mentioned in your question can be found in <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Distributedoverview">Splunk's online distributed deployment manual</A>.</P> <P>From a best practice standpoint, we generally keep search time knowledge pieces grouped with parsing configurations and send them to both searchers and parsers in a distributed environment. The parsers are happy to ignore search time pieces and the searchers are happy to ignore parsing configurations. Note: Parsing is usually done on the indexers but if a heavy forwarder is in the data acquisition path, it will do the parsing and send Splunk parsed data. </P> Thu, 25 Oct 2012 01:39:39 GMT https://community.splunk.com/t5/Getting-Data-In/Difference-between-ParsingQueue-and-IndexQueue/m-p/102364#M21477 bwooden 2012-10-25T01:39:39Z