will persistent queues work with splunktcp?

[suhprano]

This online doc says that persistent queues only work with certain input types. Will they work with splunktcp? This is the port received by thhe forwarders.

http://www.splunk.com/base/Documentation/4.2.2/Data/Usepersistentqueues

[gkanapathy · Accepted solution]

They probably will and you should probably not use them. If you're receiving splunktcp, I assume you're on an indexer, in which case if it's running, any data in the queue should be received and written into the index and not need any persistent queuing. What is the use case you are envisioning?

[suhprano]

Thanks, I have an issue where not all data are being indexed. I'm tailing a log and using a fwder to send that data over to the index, I thought the persistent queue might help with the data loss.