Where are Persistent Queues Stored in Splunk 4.2.x

dshakespeare_sp — Tue, 13 Nov 2012 17:15:17 GMT

Prior to Splunk 4.2 I used to be able to set the location of Persistent Queues using persistentQueuePath = in outputs.conf. This feature does not seem to available in 4.2.x.
Where are the Persistent Queues stored in Splunk 4.2.x?
Can I still set the location of these files to my custom path?

Re: Where are Persistent Queues Stored in Splunk 4.2.x

dshakespeare_sp — Tue, 13 Nov 2012 17:16:42 GMT

In 4.2, the persistent queue capability was re-implemented, in a much improved fashion.
It is now a feature of data inputs and is therefore configured in inputs.conf. It is not related in any way to the previous, deprecated persistent queue capability, which was configured through outputs.conf.

The key "persistentQueuePath" is no longer used in Splunk 4.2.x as the location is now "hardcoded" and is therefore no longer user configurable.

It is however possible to change the size of the Persistent Queue using the key "persistentQueueSize".

The location of the Persistent Queue is hardcoded to

$SPLUNK_HOME/var/run/splunk/[tcpin|udpin]/pq__

The Persistent Queue for TCP port 2012 would be '$SPLUNK_HOME/var/run/splunk/tcpin/pq__2012'

The Persistent Queue for UDP port 2012 would be '$SPLUNK_HOME/var/run/splunk/udpin/pq__2012'

Note: There are TWO underscores "_" in the file name.

topic Re: Where are Persistent Queues Stored in Splunk 4.2.x in Getting Data In

Where are Persistent Queues Stored in Splunk 4.2.x

Re: Where are Persistent Queues Stored in Splunk 4.2.x