Getting Data In
Highlighted

Does a universal forwarder's persistent queue exist after a reboot?

Builder

According to this document: http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/Usepersistentqueues

The in-memory data can get lost if a crash occurs. Similarly, data that is in the parsing or indexing pipeline but that has not yet been written to disk can get lost in the event of a crash.

This only refers to a 'crash'. Does Splunk write the 500K of cached data to the persistent queue in the event of a clean shutdown of the forwarder or the machine?

0 Karma
Highlighted

Re: Does a universal forwarder's persistent queue exist after a reboot?

Communicator

Yes, part of the shutdown of the service is to wait for all queues to finish. This is why Splunkd can take longer to restart at times, you can watch this happening in the logs.

View solution in original post

Highlighted

Re: Does a universal forwarder's persistent queue exist after a reboot?

Builder

Excellent. Thanks, Cooper! We're thinking about installing UFs on laptops and this was one of our concerns.

0 Karma