Getting Data In

Persistent Queues and index clustering

ckurtz
Path Finder

I've recently increased queue sizes on our indexers in our index cluster manually (editing the inputs.conf on the indexers themselves instead of on the index master, as a test) following the docs (http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Usepersistentqueues):

queueSize = 5MB

persistentQueueSize = 100MB

But when I add those same queue values on our index master and attempt to apply the bundle I get errors:

In handler 'clustermastercontrol':

Possible typo in stanza [splunktcp-ssl://9997] in /opt/splunk/etc/master-apps/asu_all_indexer_base/local/inputs.conf, line 7: queueSize = 5MB

Possible typo in stanza [splunktcp-ssl://9997] in /opt/splunk/etc/master-apps/asu_all_indexer_base/local/inputs.conf, line 8: persistentQueueSize = 100MB

Thoughts?

Tags (3)
0 Karma
1 Solution

ckurtz
Path Finder

Official answer from my support ticket:

Indexers do not prevent incorrect configurations, they only show the "possible typo" warning, but the Cluster Master does validate, so correctly throws an error when trying to apply the bundle.

The actual answer is that persistentQueue is not designed for splunktcp stanzas, as per the docs (http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Usepersistentqueues), which I'd apparently missed the section on what persistentQueue was usable on:

"Persistent queues are not available for these input types: Monitor Batch File system change,
monitor Windows event log data, splunktcp (input from Splunk forwarders)"

View solution in original post

0 Karma

ckurtz
Path Finder

Official answer from my support ticket:

Indexers do not prevent incorrect configurations, they only show the "possible typo" warning, but the Cluster Master does validate, so correctly throws an error when trying to apply the bundle.

The actual answer is that persistentQueue is not designed for splunktcp stanzas, as per the docs (http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Usepersistentqueues), which I'd apparently missed the section on what persistentQueue was usable on:

"Persistent queues are not available for these input types: Monitor Batch File system change,
monitor Windows event log data, splunktcp (input from Splunk forwarders)"

0 Karma

rturk
Builder

Hi Ckurtz,

I think I see your problem. It's in your stanza declaration. Instead of:

[splunktcp-ssl://9997]

try:

[splunktcp-ssl:9997]

Let me know how you go 🙂

References:

0 Karma

ckurtz
Path Finder

Apparently it's accepted with or without the // -- the inputs.conf doc shows both versions.

Removing the "//" doesn't solve the issue, and I certainly have it configured and working with the "//" on forwarders and indexers...

But a good catch anyway!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...