Splunk Search

will persistent queues work with splunktcp?

suhprano
Path Finder

This online doc says that persistent queues only work with certain input types. Will they work with splunktcp? This is the port received by thhe forwarders.

http://www.splunk.com/base/Documentation/4.2.2/Data/Usepersistentqueues

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

They probably will and you should probably not use them. If you're receiving splunktcp, I assume you're on an indexer, in which case if it's running, any data in the queue should be received and written into the index and not need any persistent queuing. What is the use case you are envisioning?

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

They probably will and you should probably not use them. If you're receiving splunktcp, I assume you're on an indexer, in which case if it's running, any data in the queue should be received and written into the index and not need any persistent queuing. What is the use case you are envisioning?

suhprano
Path Finder

Thanks, I have an issue where not all data are being indexed. I'm tailing a log and using a fwder to send that data over to the index, I thought the persistent queue might help with the data loss.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>