Archive
Highlighted

will persistent queues work with splunktcp?

Path Finder

This online doc says that persistent queues only work with certain input types. Will they work with splunktcp? This is the port received by thhe forwarders.

http://www.splunk.com/base/Documentation/4.2.2/Data/Usepersistentqueues

Tags (1)
0 Karma
Highlighted

Re: will persistent queues work with splunktcp?

Splunk Employee
Splunk Employee

They probably will and you should probably not use them. If you're receiving splunktcp, I assume you're on an indexer, in which case if it's running, any data in the queue should be received and written into the index and not need any persistent queuing. What is the use case you are envisioning?

View solution in original post

Highlighted

Re: will persistent queues work with splunktcp?

Path Finder

Thanks, I have an issue where not all data are being indexed. I'm tailing a log and using a fwder to send that data over to the index, I thought the persistent queue might help with the data loss.

0 Karma