Getting Data In

nullqueue or nullQueue ?

yannK
Splunk Employee
Splunk Employee

I saw this in transforms.conf : should if be nullQueue or nullqueue ?

[send_to_nullqueue]
DEST_KEY = queue
REGEX    = .
FORMAT   = nullQueue
Tags (1)
1 Solution

lguinn2
Legend

nullQueue is the correct spelling.

View solution in original post

lguinn2
Legend

nullQueue is the correct spelling.

yannK
Splunk Employee
Splunk Employee

Thank you, I tested with the wrong one, and it created 2 lines in metrics, that look identical but are not.
`
10-02-2012 08:26:13.261 -0400 INFO Metrics - group=queue, name=nullqueue, max_size_kb=500, current_size_kb=0, current_size=0, largest_size=0, smallest_size=0
10-02-2012 08:26:13.261 -0400 INFO Metrics - group=queue, name=nullqueue, blocked=true, max_size_kb=500, current_size_kb=499, current_size=998, largest_size=998, smallest_size=998

and when the wrong queue one was full, my indexer was buster, unable to accept any data. So please use the correct nullQueue.
`

0 Karma
Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...