Deployment Architecture

Does cooked data from a HF forwarder automatically gets routed to the indexing queue --> indexing processor?

splunk_force_as
Path Finder

OR does it first pass through the other three processing queues() after the input queue and get ignored by processing thread proceeding the the particular queue since it's fully cooked?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi splunk_force_ash,

Yes, cooked events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf

 /opt/splunk/etc/system/default/inputs.conf                             
route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue

Here the snip from the docs http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Inputsconf about it:

[splunktcp]
route = [has_key|absent_key:<key>:<queueName>;...]
* If a matching rule is found, the receiver sends the payload to the specified
  <queueName>.
* If no matching rule is found, the receiver sends the payload to the default
  queue specified by any queue= for this stanza. If no queue= key is set in
  the stanza or globally, the events will be sent to the parsingQueue.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi splunk_force_ash,

Yes, cooked events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf

 /opt/splunk/etc/system/default/inputs.conf                             
route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue

Here the snip from the docs http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Inputsconf about it:

[splunktcp]
route = [has_key|absent_key:<key>:<queueName>;...]
* If a matching rule is found, the receiver sends the payload to the specified
  <queueName>.
* If no matching rule is found, the receiver sends the payload to the default
  queue specified by any queue= for this stanza. If no queue= key is set in
  the stanza or globally, the events will be sent to the parsingQueue.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

splunk_force_as
Path Finder

Thanks a bunch!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!