Deployment Architecture

Could not send data to output queue (parsingQueue) and also logs getting delay

shaikhussain2
Explorer

Hi Team,

we are recieving error like "Could not send data to output queue (parsingQueue), retrying..." in splunkd log (universal forwarder) and recieving error like "Blocked=True" in indexers.
And my indexing queue is getting almost full, do we have any way to resolve this issue.

ENVIRONMENT= 3 INDEXERS(clustering)(WINDOWS) WITH 16 CORE AND 64 gb memory , 520 GB LICENSE
CLIENT= RHEL 7.5

0 Karma

vegerlandecs
Explorer

This message is telling you that queue is full.
If you increase the parsing queue it will take more memory but will handle a bit better the events before sending them through. That alone, however, may not fix the problem, since the reason why it's it's likely to be the throughput (network) in limits.conf, which is 256 kbps by default.

input flow > output flow = queueing -> delay

In a more constant flow case, it's easy to predict queueing, problem is calculating quality of service when it has surges (for context: https://en.wikipedia.org/wiki/Queueing_theory)

How to increase thruput: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Limitsconf#.5Bthruput.5D

parsing queue can be changed to something like this (server.conf):

[queue=parsingQueue]
maxSize = 2MB

Edit: forgot to add that if your indexers are rejecting inputs, you need to increase capacity, either by changing to high speed disks or adding new indexers depending on where the bottleneck is - I suggest comparing queueing graphs to disk/cpu utilisation on the indexers.
There may be ways to workaround it before you add capacity, like playing with queues and etc. However, I'm afraid that it will be best if you engage support directly in this case.

0 Karma

ridwanahmed
Path Finder

Is there a reason (beyond the obvious complaint in the log) to use parsingQueue instead of:

    [queue]
    maxSize = 2MB
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...