Hello All,
Some of the queues are getting blocked in Splunk. Need help to solve it.
How did you generate this? I would like to do the same thing.
Hi,
While looking at graph, your indexing queue is blocking continuously but percentage is low, for that you are hitting IOPS issue. Have a look at very good white paper created by @dpaper_splunk for disk diagnostics.
For parsing and Aggregation queue, it looks like due to full aggregation queue & back-pressure, parsing queue also filled 100%. I'll suggest you to find which host,source ingested more data during that time and see any splunkd.log warning or error during same time like: timestamp parsing issue. Have a look at detailed pipeline diagram on https://wiki.splunk.com/Community:HowIndexingWorks and if possible configure TIMESTAMP parameter for larger datasets so that splunk parse those data quickly which will help to remediate blocking queue issue.