https://community.splunk.com/t5/Splunk-Search/Persistent-queues-splunktcp/m-p/76528#M181471 <P>Persistent queues are not available for splunktcp, <BR /> I use several Forwarders on networks n, sending to a central forwarder on network A, from here all data goes to a central indexer, I would like to use persistent queueing for dataloss prevention. </P> <P>TCP/UPD/Syslog will work but not splunktcp.</P> <P>Is there a way for getting this to work?</P> Wed, 22 Feb 2012 16:45:39 GMT SylviaB 2012-02-22T16:45:39Z https://community.splunk.com/t5/Splunk-Search/Persistent-queues-splunktcp/m-p/76528#M181471 <P>Persistent queues are not available for splunktcp, <BR /> I use several Forwarders on networks n, sending to a central forwarder on network A, from here all data goes to a central indexer, I would like to use persistent queueing for dataloss prevention. </P> <P>TCP/UPD/Syslog will work but not splunktcp.</P> <P>Is there a way for getting this to work?</P> Wed, 22 Feb 2012 16:45:39 GMT https://community.splunk.com/t5/Splunk-Search/Persistent-queues-splunktcp/m-p/76528#M181471 SylviaB 2012-02-22T16:45:39Z https://community.splunk.com/t5/Splunk-Search/Persistent-queues-splunktcp/m-p/76529#M181472 <P>SylviaB - How are you trying to set this up? What sort of error message are you getting to say that it isn't working? I have it working currently using the following syntax</P> <P>[splunktcp://9998]<BR /> persistentQueueSize=100GB</P> Fri, 16 Mar 2012 00:56:48 GMT https://community.splunk.com/t5/Splunk-Search/Persistent-queues-splunktcp/m-p/76529#M181472 jdunlea_splunk 2012-03-16T00:56:48Z https://community.splunk.com/t5/Splunk-Search/Persistent-queues-splunktcp/m-p/76530#M181473 <P>We are also searching for more information regarding the usage of persistent queues for splunktcp.<BR /> We want to avoid for example data loss during splunk update, where you need to stop the index cluster in case of major version update.<BR /> So you will loss "live data" like it comes for excample fron the windows_TA and or unix_ta (CPU, Ram, disk, etc.)</P> <P>According to <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues:" target="_blank">http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues:</A></P> <HR /> <P>Persistent queues are not available for these input types:</P> <PRE><CODE>Monitor Batch File system change monitor splunktcp (input from Splunk forwarders) </CODE></PRE> <P>Is the above mentioned option recommended, documented and supported from splunk?</P> Tue, 29 Sep 2020 08:42:59 GMT https://community.splunk.com/t5/Splunk-Search/Persistent-queues-splunktcp/m-p/76530#M181473 glentes 2020-09-29T08:42:59Z