Getting Data In

Difference between ParsingQueue and IndexQueue?

Dark_Ichigo
Builder

Whats the difference between ParsingQuerue and IndexQueue and what their purpose when applied to both inputs.conf, transforms.conf and props.conf?

bwooden
Splunk Employee
Splunk Employee

One of the many differences (and perhaps most practical to address) is on what Splunk instance each configuration belongs. A practical guide on where Splunk settings should be configured is located on the Splunk Wiki. An overview of the pipelines mentioned in your question can be found in Splunk's online distributed deployment manual.

From a best practice standpoint, we generally keep search time knowledge pieces grouped with parsing configurations and send them to both searchers and parsers in a distributed environment. The parsers are happy to ignore search time pieces and the searchers are happy to ignore parsing configurations. Note: Parsing is usually done on the indexers but if a heavy forwarder is in the data acquisition path, it will do the parsing and send Splunk parsed data.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...