Splunk Enterprise

Pipeline processors

rroberts
Splunk Employee
Splunk Employee

Running this search index=_internal "group=pipeline" | stats sum(cpu_seconds) as totalCPUSeconds by processor | sort 10 totalCPUSeconds desc
I see the sendout processor has the totalCPUseconds lead followed closely by indexer and aggregator processors. What exactly does the sendout processor do? I see it's a part of the "parsing"

[pipeline:parsing]

disabled_processors=utf8, linebreaker, header, sendOut

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

sendOut sends data from the parsingQueue to the aggQueue(aggregator). The parsing queue does UTF8, Linebreaker, header recognition, etc. aggQueue puts the events back together by using things like SHOULD_LINEMERGE, BREAK_ONLY_BEFORE, MUST_BREAK_AFTER, etc.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

sendOut sends data from the parsingQueue to the aggQueue(aggregator). The parsing queue does UTF8, Linebreaker, header recognition, etc. aggQueue puts the events back together by using things like SHOULD_LINEMERGE, BREAK_ONLY_BEFORE, MUST_BREAK_AFTER, etc.

krdo
Communicator

I know this a (very) old question/answer, but: I see that our Splunk indexer spends most cpu_seconds for the parsing sendout processor. What exactly does it do? The amount of cpu_seconds for all other processors is magnitudes lower. May this indicate a resource problem?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

yes. There is a send out between each queue, generally speaking.

0 Karma

rroberts
Splunk Employee
Splunk Employee

So is sendOut actually involved between each queue? IE parsingQueue to aggQueue to typingQueue and so on?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...