Splunk Search

will persistent queues work with splunktcp?

suhprano
Path Finder

This online doc says that persistent queues only work with certain input types. Will they work with splunktcp? This is the port received by thhe forwarders.

http://www.splunk.com/base/Documentation/4.2.2/Data/Usepersistentqueues

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

They probably will and you should probably not use them. If you're receiving splunktcp, I assume you're on an indexer, in which case if it's running, any data in the queue should be received and written into the index and not need any persistent queuing. What is the use case you are envisioning?

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

They probably will and you should probably not use them. If you're receiving splunktcp, I assume you're on an indexer, in which case if it's running, any data in the queue should be received and written into the index and not need any persistent queuing. What is the use case you are envisioning?

suhprano
Path Finder

Thanks, I have an issue where not all data are being indexed. I'm tailing a log and using a fwder to send that data over to the index, I thought the persistent queue might help with the data loss.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...