Getting Data In

Blockage of Queue


Hello All,

Some of the queues are getting blocked in Splunk. Need help to solve it.
alt text

0 Karma

New Member

How did you generate this? I would like to do the same thing.

0 Karma



While looking at graph, your indexing queue is blocking continuously but percentage is low, for that you are hitting IOPS issue. Have a look at very good white paper created by @dpaper_splunk for disk diagnostics.

For parsing and Aggregation queue, it looks like due to full aggregation queue & back-pressure, parsing queue also filled 100%. I'll suggest you to find which host,source ingested more data during that time and see any splunkd.log warning or error during same time like: timestamp parsing issue. Have a look at detailed pipeline diagram on and if possible configure TIMESTAMP parameter for larger datasets so that splunk parse those data quickly which will help to remediate blocking queue issue.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!