Getting Data In

how to define persistent queues path?

fernandoandre
Communicator

I'm using persistent queues in a Heavy Forwarder (like this) with Splunk 4.3.x

I was searching on how to define the path where the persistent queue file is saved and I found this
(http://wiki.splunk.com/Community:Best_Practice_For_Configuring_Syslog_Input) which seems to be from August2011. However the latest versions of outputs.conf don't have any reference to the attribute "persistentQueuePath". It seems it was deprecated (?) and removed. The attribute that still exists is "maxQueueSize" that can define the size of the queue.

Does anyone knows how to define the path where Splunk saves the persistent queue? Have anyone tried this feature?

Thank you

dshakespeare_sp
Splunk Employee
Splunk Employee

persistentQueuePath is not used in Splunk 4.2.x
Only the persistentQueueSize can be changed.

The location is hardcoded to

$SPLUNK_HOME/splunk/var/run/splunk/??pin/pq_

eg
TCP:2012 = /opt/splunk4/splunk/var/run/splunk/tcppin/pq_2012
UDP:2012 = /opt/splunk4/splunk/var/run/splunk/udpin/pq_2012

Hope this helps

0 Karma

fernandoandre
Communicator

Can anyone (from Splunk maybe?) confirm that this feature is deprecated or still usable?

0 Karma

fernandoandre
Communicator

I realize that according to this (http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues) persistent queues from Splunk 4.2 are configured on inputs.conf and not on outputs.conf. However, in the latest inputs.conf there is still no attribute to define the path of the persistent queue. Only "persistentQueueSize". Are the others deprecated? Can I use "persistentQueuePath" with confidence?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...