topic Re: What does pset and ruse mean in splunkd.logs in Getting Data In

What does pset and reuse mean in splunkd.logs

dexterp — Tue, 29 Dec 2020 13:26:47 GMT

Given this search for the TcpOutputProc

index=_internal source=*splunkd.log component=TcpOutputProc | fields _raw | head 5

What do the fields pset and reuse stand for?

12-29-2020 02:35:22.998 +0000 INFO TcpOutputProc - Connected to idx=X.X.X.X:9997, pset=0, reuse=0. using ACK.
12-29-2020 02:35:22.989 +0000 INFO TcpOutputProc - Connected to idx=X.X.X.X:9997, pset=0, reuse=0. using ACK.
12-29-2020 02:35:22.987 +0000 INFO TcpOutputProc - Connected to idx=X.X.X.X:9997, pset=0, reuse=0. using ACK.
12-29-2020 02:35:22.981 +0000 INFO TcpOutputProc - Connected to idx=X.X.X.X:9997, pset=0, reuse=0. using ACK.
12-29-2020 02:35:22.976 +0000 INFO TcpOutputProc - Connected to idx=X.X.X.X:9997, pset=0, reuse=0. using ACK.

Re: What does pset and ruse mean in splunkd.logs

scelikok — Tue, 29 Dec 2020 13:19:24 GMT

Hi @dexterp,

"pset" means pipelineset on indexers. Indexers use default single pipeline set as default . If your indexers underutilized, in order to increase indexing throughput capacity you can increase this setting. Your logs show that your system uses single pipeline set. This setting can be used on forwarders and indexers or both.

You can find more detail in below document;

https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Pipelinesets

If this reply helps you an upvote is appreciated.

Re: What does pset and ruse mean in splunkd.logs

dexterp — Wed, 30 Dec 2020 00:16:25 GMT

I thought it might be pipeline set, I just wanted to confirm it with Splunk.