indexQueue

indexQueue

noun

A queue in the data pipeline that holds events that have been parsed and need to be indexed.

Incoming data first goes into the parsingQueue. From there, it goes into the parsing pipeline, where it undergoes event processing. It then moves into the indexQueue and on to the indexing pipeline, where the Splunk software stores the events on disk.

Both parsing and indexing usually take place on the indexer. However, you can separate out the parsing stage, so that it occurs instead on a heavy forwarder.

For more information

In the Distributed Deployment Manual:

• How data moves through Splunk Enterprise: the data pipeline