parsingQueue

parsingQueue

noun

A queue in the data pipeline that holds data after it enters the system, but before parsing (event processing) occurs.

Incoming data goes first to the parsingQueue and from there to the parsing pipeline, where it undergoes event processing. It then moves to the indexQueue and on to the indexing pipeline, which builds the index.

Both parsing and indexing usually take place on the indexer. However, you can separate out the parsing stage, so that it occurs instead on a heavy forwarder.

For more information

In the Distributed Deployment Manual:

• How data moves through Splunk Enterprise: the data pipeline