https://community.splunk.com/t5/Getting-Data-In/What-events-are-eligible-for-quot-dropClonedEventsOnQueueFull/m-p/233730#M45555 <P>I am doing some event duplication to a 3rd party and I want to make sure they if their receiver goes down it doesnt effect our local ingestion path.</P> <P>Originally I set up some duplication rules via props/transforms.</P> <P>ie.<BR /> props.conf<BR /> [mysourcetype]<BR /> TRANSFORMS-routing=splunk_and_customer</P> <P>transforms.conf<BR /> [splunk_and_customer]<BR /> REGEX = .<BR /> DEST_KEY=_TCP_ROUTING<BR /> FORMAT=splunk,customer</P> <P>I have since found that as we are the first ingestion point we don't need to do full event regexing to set the routing for this particular data. This method should hopefully be more efficient a method that the one above.</P> <P>So instead of props/transforms I do the tcp routing in inputs.conf</P> <P>ie. inputs.conf<BR /> [tcp://2057]<BR /> disabled = false<BR /> index = customerdata<BR /> sourcetype = mysourcetype<BR /> _TCP_ROUTING = splunk,customer.</P> <P>My question is will both methods apply "dropClonedEventsOnQueueFull" to events that fill these queues?</P> Tue, 29 Sep 2020 11:51:00 GMT Lucas_K 2020-09-29T11:51:00Z https://community.splunk.com/t5/Getting-Data-In/What-events-are-eligible-for-quot-dropClonedEventsOnQueueFull/m-p/233730#M45555 <P>I am doing some event duplication to a 3rd party and I want to make sure they if their receiver goes down it doesnt effect our local ingestion path.</P> <P>Originally I set up some duplication rules via props/transforms.</P> <P>ie.<BR /> props.conf<BR /> [mysourcetype]<BR /> TRANSFORMS-routing=splunk_and_customer</P> <P>transforms.conf<BR /> [splunk_and_customer]<BR /> REGEX = .<BR /> DEST_KEY=_TCP_ROUTING<BR /> FORMAT=splunk,customer</P> <P>I have since found that as we are the first ingestion point we don't need to do full event regexing to set the routing for this particular data. This method should hopefully be more efficient a method that the one above.</P> <P>So instead of props/transforms I do the tcp routing in inputs.conf</P> <P>ie. inputs.conf<BR /> [tcp://2057]<BR /> disabled = false<BR /> index = customerdata<BR /> sourcetype = mysourcetype<BR /> _TCP_ROUTING = splunk,customer.</P> <P>My question is will both methods apply "dropClonedEventsOnQueueFull" to events that fill these queues?</P> Tue, 29 Sep 2020 11:51:00 GMT https://community.splunk.com/t5/Getting-Data-In/What-events-are-eligible-for-quot-dropClonedEventsOnQueueFull/m-p/233730#M45555 Lucas_K 2020-09-29T11:51:00Z https://community.splunk.com/t5/Getting-Data-In/What-events-are-eligible-for-quot-dropClonedEventsOnQueueFull/m-p/233731#M45556 <P>Answer : Both of those sets of data are eligible to be dropped.</P> <P>I figured it out by letting both sets of data queue to overfilling and seeing what happened.</P> Thu, 24 Nov 2016 00:36:29 GMT https://community.splunk.com/t5/Getting-Data-In/What-events-are-eligible-for-quot-dropClonedEventsOnQueueFull/m-p/233731#M45556 Lucas_K 2016-11-24T00:36:29Z