Splunk Enterprise

Index queue blocks Syslog and Indexer

lukessi
Path Finder

Hi,

I have data going to my indexers and also selective data going though a HF off to a 3rd party via Syslog.

I know splunk works off tubes and if one stops it blocks and queue's back up the chain.

Is there any one done something clever basically they have internet issues it stops any data on that HF going to my indexer. The only think I can think of doing is having another HF that proxy's the data and I set a large queue size and say drop data after so long. There for technically never causing a block on our side.

Labels (2)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Have you already read this https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Usepersistentqueues ?

Personally I prefer to setup rsyslog servers with VIP/Loadbalancer to handle that spooling with persistent queues and enough storage. 
r. Ismo

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...