Getting Data In

Persistent queues for Windows event logs

reginaldsheetz_
New Member

Where does Splunk store the persistent queues for Windows logs. I am able to find the TCP and UDP queued logs but cannot find the Windows logs.

0 Karma
1 Solution

alemarzu
Motivator

Hello there @reginaldsheetz_mantech

The path for PQs > $SPLUNK_HOME/var/run/splunk/[tcpin|udpin]/pq__<port>

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Usepersistentqueues#Persistent_queue_l...

View solution in original post

0 Karma

alemarzu
Motivator

Hello there @reginaldsheetz_mantech

The path for PQs > $SPLUNK_HOME/var/run/splunk/[tcpin|udpin]/pq__<port>

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Usepersistentqueues#Persistent_queue_l...

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!