topic Re: What do do about blocked messages... in Splunk Dev https://community.splunk.com/t5/Splunk-Dev/What-do-do-about-blocked-messages/m-p/391777#M6600 <P>Have a look at this<BR /> <A href="https://answers.splunk.com/answers/168882/how-to-troubleshoot-blocked-queues-that-are-preven.html">https://answers.splunk.com/answers/168882/how-to-troubleshoot-blocked-queues-that-are-preven.html</A></P> Tue, 15 May 2018 19:13:49 GMT somesoni2 2018-05-15T19:13:49Z What do do about blocked messages... https://community.splunk.com/t5/Splunk-Dev/What-do-do-about-blocked-messages/m-p/391776#M6599 <P>I noticed a lot of "blocked" messages coming from one of my HFW today, and unsure what to do about it. The HFW in question processes a lot of netflow and stream events. </P> <PRE><CODE>5/15/18 05-15-2018 18:27:23.109 +0000 INFO Metrics - group=queue, name=httpin, 6.27.23.109 PM host = bos-flow01 source = /opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =truef max_size_kb=500, current_size_kb=499, current_size=1234, largest_size=1237, smallest_size=0 5/15/18 05-15-2018 18:27:23.109 +0000 INFO Metrics - group=queue, name=httpin, 6.27.23.109 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1234, largest_size=1237, smallest_size=0 5/15/18 05-15-2018 18:26:52.108 +0000 INFO Metrics - group=queue, name=typingqueue, 6.26.52.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1234, largest_size=1262, smallest_size=199 5/15/18 05-15-2018 18:26:52.108 +0000 INFO Metrics - group=queue, name=httpin, 6.26.52.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1350, smallest_size=0 5/15/18 05-15-2018 18:26:52.108 +0000 INFO Metrics - group=queue, name=typingqueue, 6.26.52.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1234, largest_size=1262, smallest_size=199 5/15/18 05-15-2018 18:26:52.108 +0000 INFO Metrics - group=queue, name=httpin, 6.26.52.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1350, smallest_size=0 5/15/18 05-15-2018 18:26:21.108 +0000 INFO Metrics - group=queue, name=typingqueue, 6.26.21.108 PM host = bos-flow01 source = /opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1243, smallest_size=250 5/15/18 05-15-2018 18:26:21.108 +0000 INFO Metrics - group=queue, name=typingqueue, 6.26.21.108 PM host = bos-flow01 source = /opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1243, smallest_size=250 5/15/18 05-15-2018 18:25:50.108 +0000 INFO Metrics - group=queue, name=indexqueue, b 6.25.50.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd locked= true, max_size_kb=500, current_size_kb=499, current_size=1160, largest_size=1291, smallest_size=175 5/15/18 05-15-2018 18:25:50.108 +0000 INFO Metrics - group=queue, name=httpin, 6.25.50.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1232, largest_size=1293, smallest_size=0 5/15/18 05-15-2018 18:25:50.108 +0000 INFO Metrics - group=queue, name=indexqueue, b 6.25.50.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd locked= true, max_size_kb=500, current_size_kb=499, current_size=1160, largest_size=1291, smallest_size=175 5/15/18 05-15-2018 18:25:50.108 +0000 INFO Metrics - group=queue, name=httpin, 6.25.50.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1232, largest_size=1293, smallest_size=0 5/15/18 05-15-2018 18:25:19.108 +0000 INFO Metrics - group=queue, name=typingqueue, 6.25.19.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1241, smallest_size=0 5/15/18 05-15-2018 18:25:19.108 +0000 INFO Metrics - group=queue, name=httpin, 6.25.19.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1238, smallest_size=0 5/15/18 05-15-2018 18:25:19.108 +0000 INFO Metrics - group=queue, name=typingqueue, 6.25.19.108 PM host = bos-flow01 source = /opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1241, smallest_size=0 </CODE></PRE> Tue, 15 May 2018 18:56:56 GMT https://community.splunk.com/t5/Splunk-Dev/What-do-do-about-blocked-messages/m-p/391776#M6599 a212830 2018-05-15T18:56:56Z Re: What do do about blocked messages... https://community.splunk.com/t5/Splunk-Dev/What-do-do-about-blocked-messages/m-p/391777#M6600 <P>Have a look at this<BR /> <A href="https://answers.splunk.com/answers/168882/how-to-troubleshoot-blocked-queues-that-are-preven.html">https://answers.splunk.com/answers/168882/how-to-troubleshoot-blocked-queues-that-are-preven.html</A></P> Tue, 15 May 2018 19:13:49 GMT https://community.splunk.com/t5/Splunk-Dev/What-do-do-about-blocked-messages/m-p/391777#M6600 somesoni2 2018-05-15T19:13:49Z