Getting Data In

caching events to disk on Universal Forwarder

ibondarets
Explorer

Hi!
According to documentation on outputs.conf, maxQueueSize sets value for amount of RAM that queue can take when indexer is down.
But I need to be able tocache large amounts of events, for example 5 or 10Gb and i want to do it using HDD.
How can I do that?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

These are the queues you're looking for.

Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...