Security

Set order of indexed data inputs

tristanmatthews
Path Finder

Does anyone know if there is a way to set what order splunk indexes things in?

The index I care about the most was added last, so seems to have the lowest priority. Or maybe not and I'm just crazy...

Thank,
Tristan

Tags (1)

gfuente
Motivator

Maybe you could increase the max kbps (if your indexers are able to ingest data faster):

http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Limitsconf

[thruput]

maxKBps = <integer>
* If specified and not zero, this limits the speed through the thruput processor to the specified 
rate in kilobytes per second.
* To control the CPU load while indexing, use this to throttle the number of events this indexer 
processes to the rate (in KBps) you specify. 

regards

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Splunk indexes things as soon as it comes in, but in the case of a backlog, it will work through it depending on a variety of internal factors. In the case of your crash, you will have to simply wait it out for things to catch up.

--
Jesse Trucks
Minister of Magic
0 Karma

tristanmatthews
Path Finder

In normal operation I think its not a problem. My problem is that my splunk index crashed over Thanksgiving (Wednesday night) without me noticing so now that I have restarted it there is a back log of data to work through.

0 Karma

somesoni2
Revered Legend

As far as I know there isn't a way to set priorities for sources of data. Splunk Indexes data as soon as they are receieved. So if you are seeing delay in the receiving your data, there could be other reasons like network delay, data size etc.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...