<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Indexes Overloaded? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Indexes-Overloaded/m-p/62235#M12430</link>
    <description>&lt;P&gt;Im currently indexing large amount of data and monitoring the process and usage from the Deployment Monitor.&lt;/P&gt;

&lt;P&gt;For some reason the Deployment Monitor is marking the current status of the indexing as &lt;STRONG&gt;"Overloaded"&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;I found some information on SplunkBase : &lt;A href="http://docs.splunk.com/Documentation/Splunk/4.2/Deploy/Troubleshootyourdeployment"&gt;http://docs.splunk.com/Documentation/Splunk/4.2/Deploy/Troubleshootyourdeployment&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;Referring that this current indexing state could cause search performance issues after indexing, is this a risk, should I re-index?&lt;/P&gt;</description>
    <pubDate>Tue, 23 Aug 2011 07:57:23 GMT</pubDate>
    <dc:creator>Dark_Ichigo</dc:creator>
    <dc:date>2011-08-23T07:57:23Z</dc:date>
    <item>
      <title>Indexes Overloaded?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Indexes-Overloaded/m-p/62235#M12430</link>
      <description>&lt;P&gt;Im currently indexing large amount of data and monitoring the process and usage from the Deployment Monitor.&lt;/P&gt;

&lt;P&gt;For some reason the Deployment Monitor is marking the current status of the indexing as &lt;STRONG&gt;"Overloaded"&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;I found some information on SplunkBase : &lt;A href="http://docs.splunk.com/Documentation/Splunk/4.2/Deploy/Troubleshootyourdeployment"&gt;http://docs.splunk.com/Documentation/Splunk/4.2/Deploy/Troubleshootyourdeployment&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;Referring that this current indexing state could cause search performance issues after indexing, is this a risk, should I re-index?&lt;/P&gt;</description>
      <pubDate>Tue, 23 Aug 2011 07:57:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Indexes-Overloaded/m-p/62235#M12430</guid>
      <dc:creator>Dark_Ichigo</dc:creator>
      <dc:date>2011-08-23T07:57:23Z</dc:date>
    </item>
    <item>
      <title>Re: Indexes Overloaded?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Indexes-Overloaded/m-p/62236#M12431</link>
      <description>&lt;P&gt;I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.&lt;/P&gt;</description>
      <pubDate>Tue, 23 Aug 2011 08:05:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Indexes-Overloaded/m-p/62236#M12431</guid>
      <dc:creator>mzorzi</dc:creator>
      <dc:date>2011-08-23T08:05:40Z</dc:date>
    </item>
    <item>
      <title>Re: Indexes Overloaded?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Indexes-Overloaded/m-p/62237#M12432</link>
      <description>&lt;P&gt;I ran the following search during to Check Indexing queues  during problem time frames:&lt;/P&gt;

&lt;P&gt;"index=_internal source="&lt;EM&gt;metrics.log&lt;/EM&gt;" group=queue | timechart perc95(current_size) by name"&lt;/P&gt;

&lt;P&gt;but there doesnt seem to be any issues with the indexing queues, unless I'm missing something.&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 09:49:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Indexes-Overloaded/m-p/62237#M12432</guid>
      <dc:creator>Dark_Ichigo</dc:creator>
      <dc:date>2020-09-28T09:49:21Z</dc:date>
    </item>
  </channel>
</rss>

