Getting Data In

Where are Persistent Queues Stored in Splunk 4.2.x

dshakespeare_sp
Splunk Employee
Splunk Employee

Prior to Splunk 4.2 I used to be able to set the location of Persistent Queues using persistentQueuePath = in outputs.conf. This feature does not seem to available in 4.2.x.
Where are the Persistent Queues stored in Splunk 4.2.x?
Can I still set the location of these files to my custom path?

Tags (1)

dshakespeare_sp
Splunk Employee
Splunk Employee

In 4.2, the persistent queue capability was re-implemented, in a much improved fashion.
It is now a feature of data inputs and is therefore configured in inputs.conf. It is not related in any way to the previous, deprecated persistent queue capability, which was configured through outputs.conf.

The key "persistentQueuePath" is no longer used in Splunk 4.2.x as the location is now "hardcoded" and is therefore no longer user configurable.

It is however possible to change the size of the Persistent Queue using the key "persistentQueueSize".

The location of the Persistent Queue is hardcoded to

$SPLUNK_HOME/var/run/splunk/[tcpin|udpin]/pq__

eg

The Persistent Queue for TCP port 2012 would be '$SPLUNK_HOME/var/run/splunk/tcpin/pq__2012'

The Persistent Queue for UDP port 2012 would be '$SPLUNK_HOME/var/run/splunk/udpin/pq__2012'

Note: There are TWO underscores "_" in the file name.

Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...