How the destination for Edge Processor works

In order to send data from an Edge Processor to a storage location such as an index or an Amazon S3 bucket, you must define the location as a destination in the Edge Processor service. Each destination contains the connection information necessary for allowing an Edge Processor to send data to a given location.

The steps for adding a destination to the Edge Processor service varies depending on whether the destination is part of a Splunk Cloud Platform deployment or a Splunk Enterprise deployment:

You can confirm the destinations that are available by checking the Destinations page, and view additional details about a given destination by selecting it.

Persistent queues

Edge Processors currently provide no data delivery guarantees. However, to help prevent data loss, the Edge Processor instance holds data in a queue if it is unable to send data to a destination or if it receives more data than it can send. If the queue fills up before the destination is available again, then the Edge Processor back pressures the data until it is ready to be sent to the destination and will continue to attempt to put data in the queue unless the Edge Processor needs to restart or shut down. If the Edge Processor instance shuts down or restarts while data is being sent, data cannot be written to a persistent queue, which can cause data loss.

Queued data is stored on the hard drive of the Edge Processor host.

On Splunk Enterprise version 10.4.0 and lower:

By default, the queue is configured to hold up to 10000 batches of events. Depending on which receiver you use, each batch can contain various amounts of events ranging from 1 to 128 events. The amount of data contained and how quickly the queue fills up varies depending on the rate at which the Edge Processor is receiving data. If you want to adjust the size of the queue, see the solution instructions in An Edge Processor fails to send data, and logs a "Dropping data because sending_queue is full" error.

On Splunk Enterprise version 10.4.1 and higher:

By default, the queue is configured to hold up to 5 gigabytes of data. For information about changing the queue size, see Edit the size of your persistent queues. To create an alert for when your persistent queue uses up a certain amount of data, see Set up alerts for Edge Processor metrics.

If your pipeline uses either the branch or route command and one of the queues for your destination is full, then data may be delivered more than once for the other healthy destinations causing data duplication.

Once the destination is available again, the Edge Processor sends the queued events to the destination. It might take some time for newer data to be processed by an Edge Processor, as the data in the queue is prioritized first.

Edit the size of your persistent queues

Change the "Storage size" setting in the Edge Processor configuration options to adjust the persistent queue size.

In Splunk Enterprise version 10.4.1 and higher, you can change the size of the persistent queues used by an Edge Processor by configuring the Storage size option. This setting determines the queue size for all instances that are part of that Edge Processor.
  1. Navigate to the Edge Processors page.
  2. In the row that lists the Edge Processor that you want to modify, select the Actions icon (Image of the Actions icon) and then select Edit Edge Processor.
  3. In the Persistent queue settings section, set the Storage size field to the desired queue size in gigabytes.
  4. Select Save.