How do we know whether typing queues are blocked or not?

[vijaysri]

Hi All,

How do we know whether typing queues are blocked or not?

Is it from Internal logs?

From the backend of the server, is it possible to find the queue blocks?

[gcusello · Accepted solution]

Hi @vijaysri,

you can find blocked queues is MOnitoring Console at [Settings -- Monitoring Console -- Indexing -- Indexing Performance: Instance]

or running a search like this

index=_internal blocked=true 
| stats count BY host

or this:

index=_internal  source=*metrics.log sourcetype=splunkd group=queue 
| eval name=case(name=="aggqueue","2 - Aggregation Queue",
 name=="indexqueue", "4 - Indexing Queue",
 name=="parsingqueue", "1 - Parsing Queue",
 name=="typingqueue", "3 - Typing Queue",
 name=="splunktcpin", "0 - TCP In Queue",
 name=="tcpin_cooked_pqueue", "0 - TCP In Queue") 
| eval max=if(isnotnull(max_size_kb),max_size_kb,max_size) 
| eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size) 
| eval fill_perc=round((curr/max)*100,2) 
| bin _time span=1m
| stats Median(fill_perc) AS "fill_percentage" by host, _time, name 
| where (fill_percentage>70 AND name!="4 - Indexing Queue") OR (fill_percentage>70 AND name="4 - Indexing Queue"

Ciao.

Giuseppe

[SanjayReddy]

hi @vijaysri 

yes from Internal logs you can check for blocking queues , especially from metrics.log  

1. you can check blocked quques from  Monioting Console 

Indexing->Performance->Indexing Performance : Instance.

2. from CLI uisng metrics.log  

more metrics.log | grep -i name=typingqueue

you can look for blocked=true messages 

FYI Queue Order 

1.parsingQueue
2.aggQueue/merginig
3.typingQueue
4.indexQueue