12/31/2023 0 Comments Outputs conf splunk![]() ![]() It cannot be overridden in a target group. It is available only at the top level stanza in nf. This attribute is only available for heavy forwarders. This is known as an "index-and-forward" configuration. Heartbeats are only sent if sendCookedData=true. Using auto load-balancing is the best way to minimize this condition, because, in that case, multiple receivers must be down (or jammed up) before queue blocking can occur. disabled Booleanĭisables default tcpout settings drop Events On Queue Full Integer Can be overridden by an nf _TCP_ROUTING setting, which in turn can be overridden by a nf/nf modifier. If you do not want to forward data automatically, do not set this attribute. The forwarder sends all data to the specified groups. The app/user context that is the namespace for the resource default Group String Set to false if you are sending to a third-party system. If false, events are raw and untouched prior to sending. If true, events are cooked (processed by Splunk software). Defaults to 500KB (which means a maximum size of 500KB for the output queue and 1500KB for the wait queue, if any). If specified as an integer followed by KB, MB, or GB (for example, maxQueueSize=100MB), maxQueueSize indicates the maximum RAM allocated to the queue buffer. For non-parsing forwarders, such as universal forwarders, that send unparsed data, maxQueueSize is the maximum number of data blocks. If specified as a lone integer (for example, maxQueueSize=100), maxQueueSize indicates the maximum number of queued events (for parsed data) or blocks of data (for unparsed data). Since events are typically much shorter than data blocks, the memory consumed by the queue on a parsing forwarder is likely to be much smaller than on a non-parsing forwarder, if you use this version of the setting. The setting determines the maximum size of the queue in-memory (RAM) buffer.įor heavy forwarders sending parsed data, maxQueueSize is the maximum number of events. It also sets the maximum size of the wait queue to 3x this value, if you have enabled indexer acknowledgment (useACK=true).Īlthough the wait queue and the output queues are both configured by this attribute, they are separate queues. ![]() Sets the maximum size of the forwarder output queue. Specifies whether to index all data locally, in addition to forwarding it. How often (in seconds) to send a heartbeat packet to the receiving server. If any target group queue is blocked, no more data reaches any other target group. Setting this to -1 or 0 causes the output queue to block when it gets full, which causes further blocking up the processing chain. Defaults to -1 (do not drop events).ĬAUTION: Do not set this value to a positive integer if you are monitoring files. If set to a positive number, wait the specified number of seconds before throwing out all new events until the output queue has space. Disabled boolĭisables default tcpout settings Drop Events On Queue Full int The app/user context that is the namespace for the resource Default Group stringĬomma-separated list of one or more target group names, specified later in stanzas of file. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |