I'm using distributed Universal Forwarders in remote location in order to collect events from remote sites. Topreventdataloss I configured persistentqueue on disk for specific inputs.
i...
...t the "Detail Diagram - Standalone Splunk" , the queues are laid out like this (one example): (persistentQueue) + udp_queue --> parsingQueue --> aggQueue --> typingQueue --> indexQueue&n...
...s to gain the benefit of Persistent queuing to store data in an input queueto disk. This can helppreventdataloss if the forwarder or indexer gets backed up. Does anyone have any thoughts on this i...
Hi Guys ...
I get a question about input queue on forwarder ?
I found a document "Usepersistentqueuestohelppreventdataloss"
I see below description in that document.
By d...
Hi,
I was wondering if there was a recommended way to ensure that an app doesn't stream too high a volume of datato avoid flooding the import queue.
For example, when running my app, I may r...
...uplicate events it can cause, but that's another issue).
I'd like to know whether the queue or list of unacknowledged events maintained on the primary indexer will persist if the primary indexer is r...
The Splunk Universal Forwarder 6.5.1 seems to skip the data added to the log file, once the splunk service was not running.
Problem: Forwarder is configured to forward and index the logs of s...
Hello All,
We have a clustered environment in multi-site running Splunk 6.6 and we would like to upgrade it to 7.2. I see in the documentation that a site-by-site would be possible only in 3 s...
Whats the alternative when link between on-prem HF to Splunk cloud goes down? how we can we preventloss of data during the interim? For syslog, we already use syslog server so no issue on that p...
...tanzas in server.conf).
* Persistentqueues can helppreventloss of transient data. For information on
persistentqueues and how the queueSize and persistentQueueSize settings
interact, see the o...