nullQueue

noun

Splunk's /dev/null equivalent. Used during data routing and filtering; you can arrange for certain incoming events to be discarded by sending them to nullQueue, while sending other events to indexQueue for indexing.

For more information

In the Distributed Deployment Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time