I'm using persistent queues in a Heavy Forwarder (like this) with Splunk 4.3.x
I was searching on how to define the path where the persistent queue file is saved and I found this
(http://wiki.splunk.com/Community:BestPracticeForConfiguringSyslog_Input) which seems to be from August2011. However the latest versions of outputs.conf don't have any reference to the attribute "persistentQueuePath". It seems it was deprecated (?) and removed. The attribute that still exists is "maxQueueSize" that can define the size of the queue.
Does anyone knows how to define the path where Splunk saves the persistent queue? Have anyone tried this feature?
persistentQueuePath is not used in Splunk 4.2.x
Only the persistentQueueSize can be changed.
The location is hardcoded to
TCP:2012 = /opt/splunk4/splunk/var/run/splunk/tcppin/pq2012
UDP:2012 = /opt/splunk4/splunk/var/run/splunk/udpin/pq2012
Hope this helps
I realize that according to this (http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues) persistent queues from Splunk 4.2 are configured on inputs.conf and not on outputs.conf. However, in the latest inputs.conf there is still no attribute to define the path of the persistent queue. Only "persistentQueueSize". Are the others deprecated? Can I use "persistentQueuePath" with confidence?