OR does it first pass through the other three processing queues() after the input queue and get ignored by processing thread proceeding the the particular queue since it's fully cooked?
Hi splunk_force_ash,
Yes, cooked
events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf
/opt/splunk/etc/system/default/inputs.conf
route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue
Here the snip from the docs http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Inputsconf about it:
[splunktcp]
route = [has_key|absent_key:<key>:<queueName>;...]
* If a matching rule is found, the receiver sends the payload to the specified
<queueName>.
* If no matching rule is found, the receiver sends the payload to the default
queue specified by any queue= for this stanza. If no queue= key is set in
the stanza or globally, the events will be sent to the parsingQueue.
Hope this helps ...
cheers, MuS
Hi splunk_force_ash,
Yes, cooked
events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf
/opt/splunk/etc/system/default/inputs.conf
route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue
Here the snip from the docs http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Inputsconf about it:
[splunktcp]
route = [has_key|absent_key:<key>:<queueName>;...]
* If a matching rule is found, the receiver sends the payload to the specified
<queueName>.
* If no matching rule is found, the receiver sends the payload to the default
queue specified by any queue= for this stanza. If no queue= key is set in
the stanza or globally, the events will be sent to the parsingQueue.
Hope this helps ...
cheers, MuS
Thanks a bunch!