What events are eligible for "dropClonedEventsOnQueueFull"?

[Lucas_K]

I am doing some event duplication to a 3rd party and I want to make sure they if their receiver goes down it doesnt effect our local ingestion path.

Originally I set up some duplication rules via props/transforms.

ie.
props.conf
[mysourcetype]
TRANSFORMS-routing=splunk_and_customer

transforms.conf
[splunk_and_customer]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=splunk,customer

I have since found that as we are the first ingestion point we don't need to do full event regexing to set the routing for this particular data. This method should hopefully be more efficient a method that the one above.

So instead of props/transforms I do the tcp routing in inputs.conf

ie. inputs.conf
[tcp://2057]
disabled = false
index = customerdata
sourcetype = mysourcetype
_TCP_ROUTING = splunk,customer.

My question is will both methods apply "dropClonedEventsOnQueueFull" to events that fill these queues?

[Lucas_K · Accepted solution]

Answer : Both of those sets of data are eligible to be dropped.

I figured it out by letting both sets of data queue to overfilling and seeing what happened.