Deployment Architecture

Could not send data to output queue (parsingQueue) and also logs getting delay

shaikhussain2
Explorer

Hi Team,

we are recieving error like "Could not send data to output queue (parsingQueue), retrying..." in splunkd log (universal forwarder) and recieving error like "Blocked=True" in indexers.
And my indexing queue is getting almost full, do we have any way to resolve this issue.

ENVIRONMENT= 3 INDEXERS(clustering)(WINDOWS) WITH 16 CORE AND 64 gb memory , 520 GB LICENSE
CLIENT= RHEL 7.5

0 Karma

vegerlandecs
Explorer

This message is telling you that queue is full.
If you increase the parsing queue it will take more memory but will handle a bit better the events before sending them through. That alone, however, may not fix the problem, since the reason why it's it's likely to be the throughput (network) in limits.conf, which is 256 kbps by default.

input flow > output flow = queueing -> delay

In a more constant flow case, it's easy to predict queueing, problem is calculating quality of service when it has surges (for context: https://en.wikipedia.org/wiki/Queueing_theory)

How to increase thruput: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Limitsconf#.5Bthruput.5D

parsing queue can be changed to something like this (server.conf):

[queue=parsingQueue]
maxSize = 2MB

Edit: forgot to add that if your indexers are rejecting inputs, you need to increase capacity, either by changing to high speed disks or adding new indexers depending on where the bottleneck is - I suggest comparing queueing graphs to disk/cpu utilisation on the indexers.
There may be ways to workaround it before you add capacity, like playing with queues and etc. However, I'm afraid that it will be best if you engage support directly in this case.

0 Karma

ridwanahmed
Path Finder

Is there a reason (beyond the obvious complaint in the log) to use parsingQueue instead of:

    [queue]
    maxSize = 2MB
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...