All Apps and Add-ons

When HF with "Splunk DB Connect" send data to Indexer, and if Indexer is down, the data will be lost?


If there is a environment like below, if Indexer is down, the data will be lost?

*HF with Splunk DB Connect

I think data input like "file monitor","data from other Universal Forwarder" etc will stop, if indexer is down, so the data won't be lost.

But I have to configure persistent queue to avoid data lost, if I use data input such "TCP","scripted input".

which type is data input of Splunk DB Connet?
Do I have to configure persistent queue?
Or Splunk DB Connet automatically stop, if outputqueue is filled?

If someone know about it , please tell me.

0 Karma


Splunk DB Connect 3 is using HEC (HTTP Event Collector) to ingest data and based on how indexing works diagram, HEC uses httpinputq but I am not able to find anything related to httpinpuq in Splunk Docs and not sure how DB connect on HFW will react when Indexer is down.

EDIT: However based on , you can set persistentQueueSize for [http://<token>]

0 Karma


I have tested below configuration in inputs.conf in my lab environment


disabled = 0
persistentQueueSize = 100MB

and after that I can see that pq_<token> file generated in $SPLUNK_HOME/var/run/splunk/httpin/ which means that it supports persistentQueue

0 Karma