https://community.splunk.com/t5/Getting-Data-In/Blockage-of-Queue/m-p/486256#M83240 <P>Hi,</P> <P>While looking at graph, your indexing queue is blocking continuously but percentage is low, for that you are hitting IOPS issue. Have a look at very good <A href="https://www.splunk.com/pdfs/technical-briefs/disk-diagnosis-digging-deep-with-monitoring-console-and-more.pdf">white paper</A> created by @dpaper_splunk for disk diagnostics. </P> <P>For parsing and Aggregation queue, it looks like due to full aggregation queue &amp; back-pressure, parsing queue also filled 100%. I'll suggest you to find which host,source ingested more data during that time and see any splunkd.log warning or error during same time like: timestamp parsing issue. Have a look at detailed pipeline diagram on <A href="https://wiki.splunk.com/Community:HowIndexingWorks">https://wiki.splunk.com/Community:HowIndexingWorks</A> and if possible configure TIMESTAMP parameter for larger datasets so that splunk parse those data quickly which will help to remediate blocking queue issue.</P> Thu, 26 Sep 2019 10:30:56 GMT harsmarvania57 2019-09-26T10:30:56Z https://community.splunk.com/t5/Getting-Data-In/Blockage-of-Queue/m-p/486255#M83239 <P>Hello All, </P> <P>Some of the queues are getting blocked in Splunk. Need help to solve it.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7712iD6A14E9128E8F196/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 26 Sep 2019 07:47:04 GMT https://community.splunk.com/t5/Getting-Data-In/Blockage-of-Queue/m-p/486255#M83239 vishaltaneja070 2019-09-26T07:47:04Z https://community.splunk.com/t5/Getting-Data-In/Blockage-of-Queue/m-p/486256#M83240 <P>Hi,</P> <P>While looking at graph, your indexing queue is blocking continuously but percentage is low, for that you are hitting IOPS issue. Have a look at very good <A href="https://www.splunk.com/pdfs/technical-briefs/disk-diagnosis-digging-deep-with-monitoring-console-and-more.pdf">white paper</A> created by @dpaper_splunk for disk diagnostics. </P> <P>For parsing and Aggregation queue, it looks like due to full aggregation queue &amp; back-pressure, parsing queue also filled 100%. I'll suggest you to find which host,source ingested more data during that time and see any splunkd.log warning or error during same time like: timestamp parsing issue. Have a look at detailed pipeline diagram on <A href="https://wiki.splunk.com/Community:HowIndexingWorks">https://wiki.splunk.com/Community:HowIndexingWorks</A> and if possible configure TIMESTAMP parameter for larger datasets so that splunk parse those data quickly which will help to remediate blocking queue issue.</P> Thu, 26 Sep 2019 10:30:56 GMT https://community.splunk.com/t5/Getting-Data-In/Blockage-of-Queue/m-p/486256#M83240 harsmarvania57 2019-09-26T10:30:56Z https://community.splunk.com/t5/Getting-Data-In/Blockage-of-Queue/m-p/486257#M83241 <P>How did you generate this? I would like to do the same thing. </P> Mon, 10 Feb 2020 14:09:22 GMT https://community.splunk.com/t5/Getting-Data-In/Blockage-of-Queue/m-p/486257#M83241 user789 2020-02-10T14:09:22Z