Getting Data In

caching events to disk on Universal Forwarder

Explorer

Hi!
According to documentation on outputs.conf, maxQueueSize sets value for amount of RAM that queue can take when indexer is down.
But I need to be able tocache large amounts of events, for example 5 or 10Gb and i want to do it using HDD.
How can I do that?

0 Karma

SplunkTrust
SplunkTrust

These are the queues you're looking for.