Splunk Cloud Platform

Use Edge Processors

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

How the destination for Edge Processor works

In order to send data from an Edge Processor to a storage location such as an index or an Amazon S3 bucket, you must define the location as a destination in the Edge Processor service. Each destination contains the connection information necessary for allowing an Edge Processor to send data to a given location.

The steps for adding a destination to the Edge Processor service varies depending on whether the destination is part of the Splunk Cloud Platform deployment that's connected to your cloud tenant:

You can confirm the destinations that are available by checking the Destinations page, and view additional details about a given destination by selecting it on the Destinations page.

What happens to my data if a destination becomes unavailable?

To prevent data loss, the Edge Processor holds data in a queue if it is unable to send data to a destination or if it receives more data than it can send. Queued data is stored on the hard drive of the Edge Processor host. If the queue fills up before the destination is available again, then data loss still occurs as the Edge Processor starts dropping any additional data that it receives. The amount of time that it takes to fill up the queue depends on the rate at which the Edge Processor is receiving data, but typically the queue holds at least 3 minutes of processing data.

Once the destination is available again, the Edge Processor sends those queued events to the destination. It might take some time for newer data to be processed by an Edge Processor as the data in the queue is prioritized first. If you want to adjust the size of the queue, see Cause: The Edge Processor queue has filled up.

Last modified on 30 August, 2023
Obtain TLS certificates for data sources and Edge Processors
Add or manage destinations

This documentation applies to the following versions of Splunk Cloud Platform: 9.0.2209, 9.0.2303, 9.0.2305 (latest FedRAMP release)

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters