Does cooked data from a HF forwarder automatically gets routed to the indexing queue --> indexing processor?

[splunk_force_as]

OR does it first pass through the other three processing queues() after the input queue and get ignored by processing thread proceeding the the particular queue since it's fully cooked?

[MuS · Accepted solution]

Hi splunk_force_ash,

Yes, cooked events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf

 /opt/splunk/etc/system/default/inputs.conf                             
route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue

Here the snip from the docs http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Inputsconf about it:

[splunktcp]
route = [has_key|absent_key:<key>:<queueName>;...]
* If a matching rule is found, the receiver sends the payload to the specified
  <queueName>.
* If no matching rule is found, the receiver sends the payload to the default
  queue specified by any queue= for this stanza. If no queue= key is set in
  the stanza or globally, the events will be sent to the parsingQueue.

Hope this helps ...

cheers, MuS

[splunk_force_as]

Thanks a bunch!