Getting Data In

Persistent queues for Windows event logs

reginaldsheetz_
New Member

Where does Splunk store the persistent queues for Windows logs. I am able to find the TCP and UDP queued logs but cannot find the Windows logs.

0 Karma
1 Solution

alemarzu
Motivator

Hello there @reginaldsheetz_mantech

The path for PQs > $SPLUNK_HOME/var/run/splunk/[tcpin|udpin]/pq__<port>

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Usepersistentqueues#Persistent_queue_l...

View solution in original post

0 Karma

alemarzu
Motivator

Hello there @reginaldsheetz_mantech

The path for PQs > $SPLUNK_HOME/var/run/splunk/[tcpin|udpin]/pq__<port>

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Usepersistentqueues#Persistent_queue_l...

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...