Archive

Typing and Index queue shows 100%

Engager

I have noticed that Splunk is running relatively slow as of recently and found that the typing queue and indexing queue are both at 100% what is that cause of this and how do you remediate this?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The typing queue is full because the indexing queue is full. The index queue is full because the disk holding the indexes is too slow. The remaining indexer queues will fill up unless the I/O problem is corrected.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

The typing queue is full because the indexing queue is full. The index queue is full because the disk holding the indexes is too slow. The remaining indexer queues will fill up unless the I/O problem is corrected.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Engager

Thank you for your reply, as a follow up: is there a certain baseline or percentage that would be an ideal number for both? e.g. 50% 40% etc?

0 Karma

SplunkTrust
SplunkTrust

The ideal number is zero.

---
If this reply helps you, an upvote would be appreciated.
0 Karma