Archive
Highlighted

Multiple Blocked Queues on Multiple Hosts

Path Finder

I run the query below every so often to see if there are any blocked queues and most of the time I see results when I run the query, the type of queues that are blocked sometimes include: indexqueue, typingqueue, structuredparsingqueue, aeq, parsingqueue, splunktcpin, aggqueue, auditqueue, and nullqueue.
Is there a reason that there is always some sort of queue that is being blocked and is there a particular queue that if blocked can have serious negative effects? Also any documentation on what each queue is meant for could also be helpful.

index=internal group=queue | eval percfull=((currentsizekb/maxsizekb)*100) | search percfull>80 blocked=true | dedup host, name | table _time host name currentsizekb maxsize_kb

Thanks in advance

0 Karma
Highlighted

Re: Multiple Blocked Queues on Multiple Hosts

SplunkTrust
SplunkTrust

The common cause of unhealthy queues is slow disk I/O rates. Very complicated regex strings can also slow the indexer and cause queues to back up.
See https://docs.splunk.com/Documentation/Splunk/8.0.3/Troubleshooting/Troubleshootindexingperformance, https://docs.splunk.com/Splexicon, and https://docs.splunk.com/Documentation/Splunk/8.0.3/DMC/IndexingDeployment for some helpful information.

---
If this reply helps you, an upvote would be appreciated.