https://community.splunk.com/t5/Splunk-Search/Multiple-Blocked-Queues-on-Multiple-Hosts/m-p/475590#M192576 <P>The common cause of unhealthy queues is slow disk I/O rates. Very complicated regex strings can also slow the indexer and cause queues to back up.<BR /> See <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/Troubleshooting/Troubleshootindexingperformance">https://docs.splunk.com/Documentation/Splunk/8.0.3/Troubleshooting/Troubleshootindexingperformance</A>, <A href="https://docs.splunk.com/Splexicon">https://docs.splunk.com/Splexicon</A>, and <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/DMC/IndexingDeployment">https://docs.splunk.com/Documentation/Splunk/8.0.3/DMC/IndexingDeployment</A> for some helpful information. </P> Tue, 14 Apr 2020 12:52:06 GMT richgalloway 2020-04-14T12:52:06Z https://community.splunk.com/t5/Splunk-Search/Multiple-Blocked-Queues-on-Multiple-Hosts/m-p/475589#M192575 <P>I run the query below every so often to see if there are any blocked queues and most of the time I see results when I run the query, the type of queues that are blocked sometimes include: indexqueue, typingqueue, structuredparsingqueue, aeq, parsingqueue, splunktcpin, aggqueue, auditqueue, and nullqueue. <BR /> Is there a reason that there is always some sort of queue that is being blocked and is there a particular queue that if blocked can have serious negative effects? Also any documentation on what each queue is meant for could also be helpful.</P> <P>index=_internal group=queue | eval percfull=((current_size_kb/max_size_kb)*100) | search percfull&gt;80 blocked=true | dedup host, name | table _time host name current_size_kb max_size_kb</P> <P>Thanks in advance</P> Wed, 30 Sep 2020 05:00:37 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Blocked-Queues-on-Multiple-Hosts/m-p/475589#M192575 wwhite12 2020-09-30T05:00:37Z https://community.splunk.com/t5/Splunk-Search/Multiple-Blocked-Queues-on-Multiple-Hosts/m-p/475590#M192576 <P>The common cause of unhealthy queues is slow disk I/O rates. Very complicated regex strings can also slow the indexer and cause queues to back up.<BR /> See <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/Troubleshooting/Troubleshootindexingperformance">https://docs.splunk.com/Documentation/Splunk/8.0.3/Troubleshooting/Troubleshootindexingperformance</A>, <A href="https://docs.splunk.com/Splexicon">https://docs.splunk.com/Splexicon</A>, and <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/DMC/IndexingDeployment">https://docs.splunk.com/Documentation/Splunk/8.0.3/DMC/IndexingDeployment</A> for some helpful information. </P> Tue, 14 Apr 2020 12:52:06 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Blocked-Queues-on-Multiple-Hosts/m-p/475590#M192576 richgalloway 2020-04-14T12:52:06Z