Getting Data In

Blockage of Queue

vishaltaneja070
Motivator

Hello All,

Some of the queues are getting blocked in Splunk. Need help to solve it.
alt text

0 Karma

user789
New Member

How did you generate this? I would like to do the same thing.

0 Karma

harsmarvania57
Ultra Champion

Hi,

While looking at graph, your indexing queue is blocking continuously but percentage is low, for that you are hitting IOPS issue. Have a look at very good white paper created by @dpaper_splunk for disk diagnostics.

For parsing and Aggregation queue, it looks like due to full aggregation queue & back-pressure, parsing queue also filled 100%. I'll suggest you to find which host,source ingested more data during that time and see any splunkd.log warning or error during same time like: timestamp parsing issue. Have a look at detailed pipeline diagram on https://wiki.splunk.com/Community:HowIndexingWorks and if possible configure TIMESTAMP parameter for larger datasets so that splunk parse those data quickly which will help to remediate blocking queue issue.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...