Getting Data In

Does an indexer write its queues to disk when we shut it down?

ddrillic
Ultra Champion

I wonder whether the contents of the Indexing queue is being written to disk when we shut down the indexer? Also, what happens to the content in the previous queues - Parsing, Aggregation and Typing queues?

0 Karma
1 Solution

micahkemp
Champion

I tried to find this in documentation (or at least another answers post) to refer to with specifics, but the general answer is Slunk will stop its inputs (monitor, splunktcp, script, etc) first, then wait for its queues to empty by being fully processed before stopping splunkd.

I wouldn't consider that "writing its queues to disk", instead it's more "stop adding to the queues and let them clear on their own".

View solution in original post

micahkemp
Champion

I tried to find this in documentation (or at least another answers post) to refer to with specifics, but the general answer is Slunk will stop its inputs (monitor, splunktcp, script, etc) first, then wait for its queues to empty by being fully processed before stopping splunkd.

I wouldn't consider that "writing its queues to disk", instead it's more "stop adding to the queues and let them clear on their own".

ddrillic
Ultra Champion

So, are we losing the data which are in the queues?

0 Karma

micahkemp
Champion

I wouldn’t expect that to happen, no.

The queues should empty prior to splunkd stopping, by way of events making their way through the remaining queues.

0 Karma

micahkemp
Champion

But again, I haven’t been able to find documentation detailing this. But this is what I have witnessed as taking place.

0 Karma

ddrillic
Ultra Champion

Fair enough ; - )

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...