SPL to identify UFs needed to increase pipeline sets

jaracan — Fri, 01 Oct 2021 07:07:36 GMT

Hi All,

We are planning to configure some of our universal forwarders to use multiple pipeline sets. Do you have some sort of SPL that we can use to identify which forwarders have blocking queues and needs to increase the number of pipeline set.

Re: SPL to identify UFs needed to increase pipeline sets

richgalloway — Fri, 01 Oct 2021 21:18:56 GMT

When a queue is blocked it's usually because something downstream is unable to keep up with things. Often that's either the network or the indexers. In those cases, adding another pipeline to the UF will just make things worse.

Use the Monitoring Console to check the health of the indexers. Treat what you find.

Increasing the maxKBps setting in the UF's limits.conf file may get things moving.

To see numbers, this query may help:

index=_internal component=Metrics group=queue

topic Re: SPL to identify UFs needed to increase pipeline sets in Splunk Search

SPL to identify UFs needed to increase pipeline sets

Re: SPL to identify UFs needed to increase pipeline sets