Getting Data In

Where are Persistent Queues Stored in Splunk 4.2.x

dshakespeare_sp
Splunk Employee
Splunk Employee

Prior to Splunk 4.2 I used to be able to set the location of Persistent Queues using persistentQueuePath = in outputs.conf. This feature does not seem to available in 4.2.x.
Where are the Persistent Queues stored in Splunk 4.2.x?
Can I still set the location of these files to my custom path?

Tags (1)

dshakespeare_sp
Splunk Employee
Splunk Employee

In 4.2, the persistent queue capability was re-implemented, in a much improved fashion.
It is now a feature of data inputs and is therefore configured in inputs.conf. It is not related in any way to the previous, deprecated persistent queue capability, which was configured through outputs.conf.

The key "persistentQueuePath" is no longer used in Splunk 4.2.x as the location is now "hardcoded" and is therefore no longer user configurable.

It is however possible to change the size of the Persistent Queue using the key "persistentQueueSize".

The location of the Persistent Queue is hardcoded to

$SPLUNK_HOME/var/run/splunk/[tcpin|udpin]/pq__

eg

The Persistent Queue for TCP port 2012 would be '$SPLUNK_HOME/var/run/splunk/tcpin/pq__2012'

The Persistent Queue for UDP port 2012 would be '$SPLUNK_HOME/var/run/splunk/udpin/pq__2012'

Note: There are TWO underscores "_" in the file name.

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...