Deployment Architecture

Does cooked data from a HF forwarder automatically gets routed to the indexing queue --> indexing processor?

splunk_force_as
Path Finder

OR does it first pass through the other three processing queues() after the input queue and get ignored by processing thread proceeding the the particular queue since it's fully cooked?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi splunk_force_ash,

Yes, cooked events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf

 /opt/splunk/etc/system/default/inputs.conf                             
route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue

Here the snip from the docs http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Inputsconf about it:

[splunktcp]
route = [has_key|absent_key:<key>:<queueName>;...]
* If a matching rule is found, the receiver sends the payload to the specified
  <queueName>.
* If no matching rule is found, the receiver sends the payload to the default
  queue specified by any queue= for this stanza. If no queue= key is set in
  the stanza or globally, the events will be sent to the parsingQueue.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi splunk_force_ash,

Yes, cooked events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf

 /opt/splunk/etc/system/default/inputs.conf                             
route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue

Here the snip from the docs http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Inputsconf about it:

[splunktcp]
route = [has_key|absent_key:<key>:<queueName>;...]
* If a matching rule is found, the receiver sends the payload to the specified
  <queueName>.
* If no matching rule is found, the receiver sends the payload to the default
  queue specified by any queue= for this stanza. If no queue= key is set in
  the stanza or globally, the events will be sent to the parsingQueue.

Hope this helps ...

cheers, MuS

0 Karma

splunk_force_as
Path Finder

Thanks a bunch!

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...