Multiple Blocked Queues on Multiple Hosts

Path Finder

I run the query below every so often to see if there are any blocked queues and most of the time I see results when I run the query, the type of queues that are blocked sometimes include: indexqueue, typingqueue, structuredparsingqueue, aeq, parsingqueue, splunktcpin, aggqueue, auditqueue, and nullqueue.
Is there a reason that there is always some sort of queue that is being blocked and is there a particular queue that if blocked can have serious negative effects? Also any documentation on what each queue is meant for could also be helpful.

index=internal group=queue | eval percfull=((currentsizekb/maxsizekb)*100) | search percfull>80 blocked=true | dedup host, name | table _time host name currentsizekb maxsize_kb

Thanks in advance

0 Karma

Re: Multiple Blocked Queues on Multiple Hosts


The common cause of unhealthy queues is slow disk I/O rates. Very complicated regex strings can also slow the indexer and cause queues to back up.
See,, and for some helpful information.

If this reply helps you, an upvote would be appreciated.