Splunk Enterprise

Pipeline processors

rroberts
Splunk Employee
Splunk Employee

Running this search index=_internal "group=pipeline" | stats sum(cpu_seconds) as totalCPUSeconds by processor | sort 10 totalCPUSeconds desc
I see the sendout processor has the totalCPUseconds lead followed closely by indexer and aggregator processors. What exactly does the sendout processor do? I see it's a part of the "parsing"

[pipeline:parsing]

disabled_processors=utf8, linebreaker, header, sendOut

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

sendOut sends data from the parsingQueue to the aggQueue(aggregator). The parsing queue does UTF8, Linebreaker, header recognition, etc. aggQueue puts the events back together by using things like SHOULD_LINEMERGE, BREAK_ONLY_BEFORE, MUST_BREAK_AFTER, etc.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

sendOut sends data from the parsingQueue to the aggQueue(aggregator). The parsing queue does UTF8, Linebreaker, header recognition, etc. aggQueue puts the events back together by using things like SHOULD_LINEMERGE, BREAK_ONLY_BEFORE, MUST_BREAK_AFTER, etc.

krdo
Communicator

I know this a (very) old question/answer, but: I see that our Splunk indexer spends most cpu_seconds for the parsing sendout processor. What exactly does it do? The amount of cpu_seconds for all other processors is magnitudes lower. May this indicate a resource problem?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

yes. There is a send out between each queue, generally speaking.

0 Karma

rroberts
Splunk Employee
Splunk Employee

So is sendOut actually involved between each queue? IE parsingQueue to aggQueue to typingQueue and so on?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...