Share a Tip

How to best configure Splunk tcpout persistent queue.

hrawat
Splunk Employee
Splunk Employee

How to best configure persistent queue at tcpout

1. Don't set queueSize in outputs.conf. Leave it to default 0.

2. For IUF/HF/SH/IDX(indexAndForward), set maxQueueSize minimum 20MB to avoid frequent PQ operations.

3. Set persistentQueueSize as per disk space availability.

 


NOTE: Recently discovered that tcpout can read PQ (assuming PQ has lot of data due to indexing tier outage) at unbounded speed but can not push at the same speed over TCP layer. This results in high memory spike.
Issue is fixed for  upcoming 9.4.13/10.0.7/10.2.4/10.4.1 patches.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...