Splunk Enterprise

Index queue blocks Syslog and Indexer

lukessi
Path Finder

Hi,

I have data going to my indexers and also selective data going though a HF off to a 3rd party via Syslog.

I know splunk works off tubes and if one stops it blocks and queue's back up the chain.

Is there any one done something clever basically they have internet issues it stops any data on that HF going to my indexer. The only think I can think of doing is having another HF that proxy's the data and I set a large queue size and say drop data after so long. There for technically never causing a block on our side.

Labels (2)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Have you already read this https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Usepersistentqueues ?

Personally I prefer to setup rsyslog servers with VIP/Loadbalancer to handle that spooling with persistent queues and enough storage. 
r. Ismo

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...