Monitoring Splunk

UF queues when Indexer down.

hectorvp
Communicator

Incase indexer is down or has slow speed for writing events in a disk,

I guess in these cases UFs parsing queue and output queue would be full enough and considering

dropEventsOnQueueFull = -1

 Suppose indexer was up again upon next day,

From where would UF start events, from where he had left off reading files or would drop events???

Can I consider that in metrics.log  if group=queue  and blocked=true, the IF is blocked and may drop events

Or will it send all logs when queue has space or indexer is up and running, where he had left off.

I don't have option of persistent queue bcoz I may monitor some logs files using monitor stanza

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

UF starts reading where it has left before output queue is full. It's own situation has stored on fishbucket index. But if you don't use persistent queues and UF will go down before it can send events to IDX then you will lost those events which are in output queue as those are just memory queues with normal configuration.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...