I am doing some event duplication to a 3rd party and I want to make sure they if their receiver goes down it doesnt effect our local ingestion path.
Originally I set up some duplication rules via props/transforms.
ie.
props.conf
[mysourcetype]
TRANSFORMS-routing=splunk_and_customer
transforms.conf
[splunk_and_customer]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=splunk,customer
I have since found that as we are the first ingestion point we don't need to do full event regexing to set the routing for this particular data. This method should hopefully be more efficient a method that the one above.
So instead of props/transforms I do the tcp routing in inputs.conf
ie. inputs.conf
[tcp://2057]
disabled = false
index = customerdata
sourcetype = mysourcetype
_TCP_ROUTING = splunk,customer.
My question is will both methods apply "dropClonedEventsOnQueueFull" to events that fill these queues?
Answer : Both of those sets of data are eligible to be dropped.
I figured it out by letting both sets of data queue to overfilling and seeing what happened.
Answer : Both of those sets of data are eligible to be dropped.
I figured it out by letting both sets of data queue to overfilling and seeing what happened.