Splunk Cloud Platform

Use Edge Processors

Edit or delete pipelines for Edge Processors

You can view, edit, and delete pipelines from the Pipelines page in your tenant. Select a pipeline to view information such as the description of the pipeline, the number of Edge Processors that it is applied to, and the SPL2 statement that it is using.

For instructions on how to work with pipelines, see the following sections:

Edit a pipeline

You can modify the SPL2 statement of a pipeline or select a different data source or destination for the pipeline by completing the following steps.

  1. Navigate to the Pipelines page.
  2. In the row that lists your pipeline, select the Actions icon (Image of the Actions icon) and select Edit.
  3. Modify the pipeline as needed, and then select Save pipeline.
  4. If you're updating a pipeline that is applied to one or more Edge Processors, then the Edge Processor service displays a list of the Edge Processors that are affected by your edits. Verify that your pipeline edits are appropriate for all of these Edge Processors, and then click Save to continue.

If the pipeline was applied to any Edge Processors before you edited it, then the Edge Processor service re-applies the pipeline to those Edge Processors. It can take a few minutes for this process to be completed. During this time, the affected Edge Processors enter the Pending status.

To confirm that the process completed successfully, do the following:

  • Navigate to the Edge Processors page. Then, verify that the Instance health column for the affected Edge Processors shows that all instances are back in the Healthy status.
  • Navigate to the Pipelines page. Then, verify that the Applied column for the pipeline contains a The pipeline is applied icon (Image of the "applied pipeline" icon).

You might need to refresh your browser to see the latest updates.

Update pipeline metadata

You can rename a pipeline or update the optional description associated with it by completing the following steps.

  1. Navigate to the Pipelines page.
  2. In the row that lists your pipeline, select the Actions icon (Image of the Actions icon) and select Update metadata.
  3. Modify the pipeline name and description as needed, and then select Save.

Refresh a pipeline

When your pipeline is applied to an Edge Processor, the pipeline does not automatically detect configuration changes to the source type or the destination that it is using. To refresh a pipeline so that it uses the latest source type and destination configurations, do either of the following:

  • Edit the pipeline and save your changes. You must edit the pipeline in a way that changes how it works. For example, adding a line of empty space after the SPL2 statement does not cause the pipeline to be refreshed, but adding a processing command causes a refresh. See the Edit a pipeline section on this page for more information.
  • Remove the pipeline from the Edge Processor and then re-apply it. See Remove pipelines from Edge Processors and Apply pipelines to Edge Processors for more information.

    Be aware that removing and re-applying a pipeline can create some gaps in your data. If your data sources send data to the Edge Processor during that time, that data doesn't get processed by the pipeline that you're re-applying.

Delete a pipeline

You can delete a pipeline from the system by completing the following steps.

Prerequisites

The pipeline must not be applied to any Edge Processors. See Remove pipelines from Edge Processors for instructions on how to remove a pipeline from an Edge Processor.

Steps

  1. Navigate to the Pipelines page.
  2. In the row that lists your pipeline, select the Actions icon (Image of the Actions icon) and select Delete.
  3. When prompted to confirm your choice, select Delete.

The Edge Processor service returns a message confirming that your pipeline was deleted successfully.

Last modified on 23 August, 2023
Create pipelines for Edge Processors   Keyboard shortcuts for Edge Processor

This documentation applies to the following versions of Splunk Cloud Platform: 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403, 9.2.2406 (latest FedRAMP release), 9.3.2408


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters