Splunk Enterprise

Index queue blocks Syslog and Indexer

lukessi
Path Finder

Hi,

I have data going to my indexers and also selective data going though a HF off to a 3rd party via Syslog.

I know splunk works off tubes and if one stops it blocks and queue's back up the chain.

Is there any one done something clever basically they have internet issues it stops any data on that HF going to my indexer. The only think I can think of doing is having another HF that proxy's the data and I set a large queue size and say drop data after so long. There for technically never causing a block on our side.

Labels (2)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Have you already read this https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Usepersistentqueues ?

Personally I prefer to setup rsyslog servers with VIP/Loadbalancer to handle that spooling with persistent queues and enough storage. 
r. Ismo

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...