What happens to data when the output queue for network inputs is full?

When the output queue for network inputs is full, data is stored in the memory queue. This mechanism allows Splunk to manage the incoming data effectively without losing valuable information. The memory queue acts as a temporary storage for incoming events until the output queue can process them further. By storing data in the memory queue, Splunk ensures that it has a buffer to temporarily hold events, allowing for some resilience in the data pipeline at times of high ingest rates or when downstream systems are slow to accept data.

This behavior is crucial for maintaining data integrity and reliability in distributed systems, ensuring that data is eventually processed as long as there is available memory to hold it. In contrast, other responses could imply loss of data or an inadequate handling mechanism that does not align with Splunk's design philosophy of robust data management.