- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- No persistentqueue attributes in outputs.conf. How...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I was referring to this link, https://wiki.splunk.com/Community:Best_Practice_For_Configuring_Syslog_Input to configure data buffering on Heavy Forwarder. The instructions provided talk about configuring the below attributes in outputs.conf,
- maxQueueSize = integer
- usePersistentQueue = true/false
- persistentQueuePath = absolute_path_that_must_exist
- maxPersistentQueueSizeInMegs = integer
However, except maxQueueSize, no other attributes can be found in the outputs.conf file.
Please advise how can I configure data buffering in this case.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
1 is in outputs.conf and 2 and 4 are deprecated. Unfortunately, the community wiki is pretty out of date and not really supported. For example, it suggests Heavy Forwarder which is actually VERY wrong in the latest versions (should always be UF):
https://www.splunk.com/blog/2016/12/12/universal-or-heavy-that-is-the-question.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So you mean UF can be used for data buffering ? if yes, can you please share the documentation for the configuration ? Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, HF is supported but only recommended if:
1: You have to transform most of the data before sending it to indexers
OR
2: You are using Modular Inputs
Otherwise, use UF as the aggregation.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @woodcock, sorry if my question isn't clear enough.
What my main question is , how I can configure Heavy Forwarder to buffer data if Indexer goes down ?
You have mentioned that the 1, 2 and 4 settings are deprecated, but HF still supports data buffering.
So, can you please suggest what are the other steps required to configure that ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your best bet is to read these 4 files:
$SPLUNK_HOME/etc/system/README/outputs.conf.spec
$SPLUNK_HOME/etc/system/README/outputs.conf.examples
$SPLUNK_HOME/etc/system/README/limits.conf.spec
$SPLUNK_HOME/etc/system/README/limits.conf.examples
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
