Splunk Enterprise

Index queue blocks Syslog and Indexer

lukessi
Path Finder

Hi,

I have data going to my indexers and also selective data going though a HF off to a 3rd party via Syslog.

I know splunk works off tubes and if one stops it blocks and queue's back up the chain.

Is there any one done something clever basically they have internet issues it stops any data on that HF going to my indexer. The only think I can think of doing is having another HF that proxy's the data and I set a large queue size and say drop data after so long. There for technically never causing a block on our side.

Labels (2)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Have you already read this https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Usepersistentqueues ?

Personally I prefer to setup rsyslog servers with VIP/Loadbalancer to handle that spooling with persistent queues and enough storage. 
r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...