https://docs.splunk.com/Documentation/Splunk/9.4.0/ReleaseNotes/MeetSplunk#What.27s_New_in_9.4
Why New Splunk TcpOutput Persistent Queue?
- Don't have to pay for third party PQ & S3 puts.
- Third party/ external S3 queue introduces permanent additional latency( due to detour to external S3 queue).
- Third party/ external S3 queuing requires batching events, which adds additional latency in order to reduce S3 puts cost.
- Unwanted additional network bandwidth usage incurred due to uploading all data to S3 and then downloading .
- Third party imposes upload payload size limits.
- On demand persistent queuing on forwarding tier when Indexer Clustering is down.
- On demand persistent queuing on forwarding tier when Indexer Clustering indexing is slow due to high system load.
- On demand persistent queuing on forwarding tier when Indexer Clustering is in rolling restart.
