topic How do we know whether typing queues are blocked or not? in Getting Data In

How do we know whether typing queues are blocked or not?

VijaySrrie — Thu, 24 Feb 2022 14:39:59 GMT

Hi All,

How do we know whether typing queues are blocked or not?

Is it from Internal logs?

From the backend of the server, is it possible to find the queue blocks?

Re: typing queues are blocked

SanjayReddy — Thu, 24 Feb 2022 05:15:31 GMT

hi @VijaySrrie

yes from Internal logs you can check for blocking queues , especially from metrics.log

1. you can check blocked quques from Monioting Console

Indexing->Performance->Indexing Performance : Instance.

2. from CLI uisng metrics.log

more metrics.log | grep -i name=typingqueue

you can look for blocked=true messages

FYI Queue Order

1.parsingQueue
2.aggQueue/merginig
3.typingQueue
4.indexQueue

Re: typing queues are blocked

gcusello — Thu, 24 Feb 2022 06:42:47 GMT

Hi @VijaySrrie,

you can find blocked queues is MOnitoring Console at [Settings -- Monitoring Console -- Indexing -- Indexing Performance: Instance]

or running a search like this

index=_internal blocked=true | stats count BY host

or this:

index=_internal source=*metrics.log sourcetype=splunkd group=queue | eval name=case(name=="aggqueue","2 - Aggregation Queue", name=="indexqueue", "4 - Indexing Queue", name=="parsingqueue", "1 - Parsing Queue", name=="typingqueue", "3 - Typing Queue", name=="splunktcpin", "0 - TCP In Queue", name=="tcpin_cooked_pqueue", "0 - TCP In Queue") | eval max=if(isnotnull(max_size_kb),max_size_kb,max_size) | eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size) | eval fill_perc=round((curr/max)*100,2) | bin _time span=1m | stats Median(fill_perc) AS "fill_percentage" by host, _time, name | where (fill_percentage>70 AND name!="4 - Indexing Queue") OR (fill_percentage>70 AND name="4 - Indexing Queue"

Ciao.

Giuseppe