Set order of indexed data inputs

[tristanmatthews]

Does anyone know if there is a way to set what order splunk indexes things in?

The index I care about the most was added last, so seems to have the lowest priority. Or maybe not and I'm just crazy...

Thank,
Tristan

[gfuente]

Maybe you could increase the max kbps (if your indexers are able to ingest data faster):

http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Limitsconf

[thruput]

maxKBps = <integer>
* If specified and not zero, this limits the speed through the thruput processor to the specified 
rate in kilobytes per second.
* To control the CPU load while indexing, use this to throttle the number of events this indexer 
processes to the rate (in KBps) you specify. 

regards

[jtrucks]

Splunk indexes things as soon as it comes in, but in the case of a backlog, it will work through it depending on a variety of internal factors. In the case of your crash, you will have to simply wait it out for things to catch up.

[tristanmatthews]

In normal operation I think its not a problem. My problem is that my splunk index crashed over Thanksgiving (Wednesday night) without me noticing so now that I have restarted it there is a back log of data to work through.

[somesoni2]

As far as I know there isn't a way to set priorities for sources of data. Splunk Indexes data as soon as they are receieved. So if you are seeing delay in the receiving your data, there could be other reasons like network delay, data size etc.