Archive

Does cooked data from a HF forwarder automatically gets routed to the indexing queue --> indexing processor?

Path Finder

OR does it first pass through the other three processing queues() after the input queue and get ignored by processing thread proceeding the the particular queue since it's fully cooked?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi splunk_force_ash,

Yes, cooked events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf

 /opt/splunk/etc/system/default/inputs.conf                             
route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue

Here the snip from the docs http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Inputsconf about it:

[splunktcp]
route = [has_key|absent_key:<key>:<queueName>;...]
* If a matching rule is found, the receiver sends the payload to the specified
  <queueName>.
* If no matching rule is found, the receiver sends the payload to the default
  queue specified by any queue= for this stanza. If no queue= key is set in
  the stanza or globally, the events will be sent to the parsingQueue.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi splunk_force_ash,

Yes, cooked events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf

 /opt/splunk/etc/system/default/inputs.conf                             
route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue

Here the snip from the docs http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Inputsconf about it:

[splunktcp]
route = [has_key|absent_key:<key>:<queueName>;...]
* If a matching rule is found, the receiver sends the payload to the specified
  <queueName>.
* If no matching rule is found, the receiver sends the payload to the default
  queue specified by any queue= for this stanza. If no queue= key is set in
  the stanza or globally, the events will be sent to the parsingQueue.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

Path Finder

Thanks a bunch!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!