com.splunk

Class OutputDefault

java.lang.Object

com.splunk.Resource

com.splunk.Entity

com.splunk.OutputDefault

All Implemented Interfaces:

Map<String,Object>

public class OutputDefault
extends Entity

The OutputDefault class represents the default TCP output configuration, providing access to global TCP output properties.

Nested Class Summary

Nested classes/interfaces inherited from interface java.util.Map

Map.Entry<K,V>

Field Summary

Fields inherited from class com.splunk.Entity

content, toUpdate

Fields inherited from class com.splunk.Resource

actions, path, refreshArgs, service, title, updated

Method Summary

Modifier and Type	Method and Description
boolean	blockOnQueueFull() Indicates whether this forwarder blocks when the output queue is full.
boolean	getAutoLB() Indicates whether this forwarder performs automatic load balancing.
int	getAutoLBFrequency() Returns the frequency of automatic load balancing.
int	getDropEventsOnQueueFull() Returns the amount of time this forwarder waits before dropping events if the output queue is full.
String	getForwardedIndex0Whitelist() Returns the inclusive set of indexes (whitelist 0) for this forwarder.
String	getForwardedIndex1Blacklist() Returns the exclusive set of indexes (blacklist 1) for this forwarder.
String	getForwardedIndex2Whitelist() Returns the inclusive set of indexes (whitelist 2) for this forwarder.
int	getHeartbeatFrequency() Returns the frequency that specifies how often to send a heartbeat packet to the receiving server.
String	getMaxQueueSize() Returns the maximum size of the output queue for this forwarder.
boolean	getSendCookedData() Indicates whether Splunk has processed ("cooked") the event data.
boolean	indexAndForward() Indicates whether to index data locally in addition to forwarding it.
boolean	isCompressed() Indicates whether this forwarder sends compressed data.
boolean	isForwardedIndexFilterDisable() Indicates whether the index filter for this forwarder is disabled.
protected boolean	isNameChangeAllowed() Returns whether this entity's name can be changed via Entity.update(java.util.Map<java.lang.String, java.lang.Object>).
void	setDropEventsOnQueueFull(int dropEventsOnQueueFull) Sets how long to wait before throwing out all new events until the output queue has space.
void	setHeartbeatFrequency(int frequency) Sets the frequency between heartbeat packets that are sent to the receiving server.
void	setIndexAndForward(boolean indexAndForward) Sets whether to index all data locally, in addition to forwarding it.
void	setMaxQueueSize(String maxQueueSize) Sets the maximum size of the forwarder's output queue.
void	setName() Sets the name.
void	setSendCookedData(boolean sendCookedData) Sets whether to forward cooked data.
void	update() Updates the entity with the accumulated arguments, established by the individual setter methods for each specific entity class.
void	update(Map<String,Object> args) Updates the entity with the values you previously set using the setter methods, and any additional specified arguments.

Methods inherited from class com.splunk.Entity

actionPath, clear, containsKey, containsValue, disable, enable, entrySet, get, getContent, getMetadata, isDisabled, isEmpty, keySet, put, putAll, refresh, remove, remove, size, validate, values

Methods inherited from class com.splunk.Resource

getName, getPath, getService, getTitle, getUpdated, invalidate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.util.Map

compute, computeIfAbsent, computeIfPresent, equals, forEach, getOrDefault, hashCode, merge, putIfAbsent, remove, replace, replace, replaceAll

Method Detail

getAutoLB

public boolean getAutoLB()

Indicates whether this forwarder performs automatic load balancing. When true, this forwarder selects a new indexer using the frequency specified by autoLBFrequency, or immediately when an open connection to an indexer is lost.

Returns:

true if this forwarder performs automatic load balancing, false if not.

See Also:

getAutoLBFrequency()

blockOnQueueFull

public boolean blockOnQueueFull()

Indicates whether this forwarder blocks when the output queue is full. Blocking causes further blocking up the processing chain--if any target group's queue is blocked, no more data reaches any other target group. When false, events are dropped when indexers in the group can't be reached.

Returns:

true if this forwarder will block, false if not.

getAutoLBFrequency

public int getAutoLBFrequency()

Returns the frequency of automatic load balancing.

Returns:

The automatic load-balancing frequency in seconds, or -1 if not specified.

getDropEventsOnQueueFull

public int getDropEventsOnQueueFull()

Returns the amount of time this forwarder waits before dropping events if the output queue is full. A setting of 0 or -1 causes this forwarder to block.

Returns:

The wait time, in seconds.

getForwardedIndex0Whitelist

public String getForwardedIndex0Whitelist()

Returns the inclusive set of indexes (whitelist 0) for this forwarder. This is an ordered list of whitelists and blacklists, which together decide if events should be forwarded to an index.

Returns:

The inclusive set of indexes.

getForwardedIndex1Blacklist

public String getForwardedIndex1Blacklist()

Returns the exclusive set of indexes (blacklist 1) for this forwarder. This is an ordered list of whitelists and blacklists, which together decide if events should be forwarded to an index.

Returns:

The exclusive set of indexes.

getForwardedIndex2Whitelist

public String getForwardedIndex2Whitelist()

Returns the inclusive set of indexes (whitelist 2) for this forwarder. This is an ordered list of whitelists and blacklists, which together decide if events should be forwarded to an index.

Returns:

The inclusive set of indexes.

getHeartbeatFrequency

public int getHeartbeatFrequency()

Returns the frequency that specifies how often to send a heartbeat packet to the receiving server.

Note: This field is only used when SendCookedData is true.

Returns:

The heartbeat frequency, in seconds.

See Also:

getSendCookedData(), setSendCookedData(boolean)

getMaxQueueSize

public String getMaxQueueSize()

Returns the maximum size of the output queue for this forwarder. The maximum size of the wait queue is set to three times this value.

Returns:

The maximum size of the output queue. The string maybe "auto" or a number followed by one of the suffixes "B", "KB", "MB", or "GB" (for bytes, kilobytes, megabytes, and gigabytes, respectively).

getSendCookedData

public boolean getSendCookedData()

Indicates whether Splunk has processed ("cooked") the event data.

Returns:

true if the event data has been processed, false if not.

indexAndForward

public boolean indexAndForward()

Indicates whether to index data locally in addition to forwarding it.

Note: This setting is not available for light forwarders.

Returns:

true if data is indexed locally and forwarded, false if not.

isCompressed

public boolean isCompressed()

Indicates whether this forwarder sends compressed data.

Returns:

true if this forwarder sends compressed data, false if not.

isNameChangeAllowed

protected boolean isNameChangeAllowed()

Description copied from class: Entity

Returns whether this entity's name can be changed via Entity.update(java.util.Map<java.lang.String, java.lang.Object>). Most entity names cannot be changed in this way.

Overrides:

isNameChangeAllowed in class Entity

Returns:

false.

isForwardedIndexFilterDisable

public boolean isForwardedIndexFilterDisable()

Indicates whether the index filter for this forwarder is disabled.

Returns:

true if the index filter is disabled, false if events are raw and untouched before sending.

setDropEventsOnQueueFull

public void setDropEventsOnQueueFull(int dropEventsOnQueueFull)

Sets how long to wait before throwing out all new events until the output queue has space. The default value is -1, which means to not drop events.

Caution: Do not set this value to a positive integer if you are monitoring files.

Setting this to -1 or 0 causes the output queue to block when it gets full, which causes further blocking up the processing chain. If any target group's queue is blocked, no more data reaches any other target group.

Using auto load-balancing is the best way to minimize this condition, because, in that case, multiple receivers must be down or jammed before queue blocking can occur.

Parameters:

dropEventsOnQueueFull - The time to wait before throwing out events, in seconds, or -1 to not drop events.

See Also:

getAutoLB()

setHeartbeatFrequency

public void setHeartbeatFrequency(int frequency)

Sets the frequency between heartbeat packets that are sent to the receiving server.

Note: Heartbeats are only sent when SendCookedData is true.

Parameters:

frequency - The frequency, in seconds.

See Also:

getSendCookedData(), setSendCookedData(boolean)

setIndexAndForward

public void setIndexAndForward(boolean indexAndForward)

Sets whether to index all data locally, in addition to forwarding it. This configuration is known as "index-and-forward". This attribute is only available for heavy forwarders, at the top-level [tcpout] stanza in outputs.conf. It cannot be overridden in a target group.

Parameters:

indexAndForward - true to index and forward data, false to forward only.

setMaxQueueSize

public void setMaxQueueSize(String maxQueueSize)

Sets the maximum size of the forwarder's output queue. This value also sets the maximum size of the wait queue to three times this value, if you have enabled indexer acknowledgment (the useACK attribute is set to true in the forwarder's outputs.conf).

Although the wait queue and the output queues are both configured by this attribute, they are separate queues. The setting determines the maximum size of the queue's in-memory (RAM) buffer.

For heavy forwarders that send parsed data, maxQueueSize is the maximum number of events. Because events are typically much shorter than data blocks, the memory consumed by the queue on a parsing forwarder will likely be much smaller than on a non-parsing forwarder, if you use this version of the setting.

If you specify an integer (for example, "100"), maxQueueSize indicates the maximum number of queued events (for parsed data) or blocks of data (for unparsed data). A block of data is approximately 64KB. For non-parsing forwarders that send unparsed data, such as universal forwarders, maxQueueSize is the maximum number of data blocks.

If specified as an integer followed by "KB", MB", or "GB" (for example, "100MB"), maxQueueSize indicates the maximum RAM allocated to the queue buffer. The default is 500KB (which means a maximum size of 500KB for the output queue and 1500KB for the wait queue, if any).

Parameters:

maxQueueSize - The maximum queue size as a number, or a number followed by "KB", MB", or "GB".

setName

public void setName()

Sets the name. Only "tcpout" is valid.

setSendCookedData

public void setSendCookedData(boolean sendCookedData)

Sets whether to forward cooked data.

Parameters:

sendCookedData - true for Splunk to process events before sending them, false to send raw and untouched events.

update

public void update(Map<String,Object> args)

Updates the entity with the values you previously set using the setter methods, and any additional specified arguments. The specified arguments take precedent over the values that were set using the setter methods.

Overrides:

update in class Entity

Parameters:

args - The arguments to update.

update

public void update()

Updates the entity with the accumulated arguments, established by the individual setter methods for each specific entity class.

Overrides:

update in class Entity