topic Re: Does Splunk Universal Forwarders contain an option to enable persistent queues? in Getting Data In

Does Splunk Universal Forwarders contain an option to enable persistent queues?

ppuru — Thu, 15 Feb 2018 05:24:57 GMT

As per Splunk documentation, "Persistent queues are not available for splunktcp (input from Splunk forwarders)". Does this mean UF's can't leverage the anti data loss advantages of persistent queues?

Re: Does Splunk Universal Forwarders contain an option to enable persistent queues?

HiroshiSatoh — Thu, 15 Feb 2018 05:59:49 GMT

According to the manual

Persistent queuing is available for certain types of inputs, but not all. Generally speaking, it is available for inputs of an ephemeral nature, such as network inputs, but not for inputs that have their own form of persistence, such as file monitoring.

Is not it that there is no problem because it has its own persistence?

Re: Does Splunk Universal Forwarders contain an option to enable persistent queues?

ppuru — Thu, 22 Feb 2018 09:55:54 GMT

Thanks for the response.
I guess in which case the answer is no.

Re: Does Splunk Universal Forwarders contain an option to enable persistent queues?

FrankVl — Thu, 22 Feb 2018 11:59:28 GMT

No in which sense? As far as I know persistent queues are available on UF, but as the document states: only for specific inputs.

So if you have direct UDP or TCP inputs going to your UF (or any of the other that support persistent queues), you can queue those.

Note: splunktcp is a specific type of input to receive data from other forwarders, it is not the same as a normal TCP input. Splunktcp not supporting persistent queues is no problem, because you should be able to solve that on the original forwarder that first collected the data.

Re: Does Splunk Universal Forwarders contain an option to enable persistent queues?

HiroshiSatoh — Thu, 22 Feb 2018 14:57:17 GMT

Thanks FrankVl. I think so, too.