Splunk Enterprise

Index queue blocks Syslog and Indexer

lukessi
Path Finder

Hi,

I have data going to my indexers and also selective data going though a HF off to a 3rd party via Syslog.

I know splunk works off tubes and if one stops it blocks and queue's back up the chain.

Is there any one done something clever basically they have internet issues it stops any data on that HF going to my indexer. The only think I can think of doing is having another HF that proxy's the data and I set a large queue size and say drop data after so long. There for technically never causing a block on our side.

Labels (2)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Have you already read this https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Usepersistentqueues ?

Personally I prefer to setup rsyslog servers with VIP/Loadbalancer to handle that spooling with persistent queues and enough storage. 
r. Ismo

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...