Hi All,
How do we know whether typing queues are blocked or not?
Is it from Internal logs?
From the backend of the server, is it possible to find the queue blocks?
Hi @VijaySrrie,
you can find blocked queues is MOnitoring Console at [Settings -- Monitoring Console -- Indexing -- Indexing Performance: Instance]
or running a search like this
index=_internal blocked=true
| stats count BY host
or this:
index=_internal source=*metrics.log sourcetype=splunkd group=queue
| eval name=case(name=="aggqueue","2 - Aggregation Queue",
name=="indexqueue", "4 - Indexing Queue",
name=="parsingqueue", "1 - Parsing Queue",
name=="typingqueue", "3 - Typing Queue",
name=="splunktcpin", "0 - TCP In Queue",
name=="tcpin_cooked_pqueue", "0 - TCP In Queue")
| eval max=if(isnotnull(max_size_kb),max_size_kb,max_size)
| eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size)
| eval fill_perc=round((curr/max)*100,2)
| bin _time span=1m
| stats Median(fill_perc) AS "fill_percentage" by host, _time, name
| where (fill_percentage>70 AND name!="4 - Indexing Queue") OR (fill_percentage>70 AND name="4 - Indexing Queue"
Ciao.
Giuseppe
Hi @VijaySrrie,
you can find blocked queues is MOnitoring Console at [Settings -- Monitoring Console -- Indexing -- Indexing Performance: Instance]
or running a search like this
index=_internal blocked=true
| stats count BY host
or this:
index=_internal source=*metrics.log sourcetype=splunkd group=queue
| eval name=case(name=="aggqueue","2 - Aggregation Queue",
name=="indexqueue", "4 - Indexing Queue",
name=="parsingqueue", "1 - Parsing Queue",
name=="typingqueue", "3 - Typing Queue",
name=="splunktcpin", "0 - TCP In Queue",
name=="tcpin_cooked_pqueue", "0 - TCP In Queue")
| eval max=if(isnotnull(max_size_kb),max_size_kb,max_size)
| eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size)
| eval fill_perc=round((curr/max)*100,2)
| bin _time span=1m
| stats Median(fill_perc) AS "fill_percentage" by host, _time, name
| where (fill_percentage>70 AND name!="4 - Indexing Queue") OR (fill_percentage>70 AND name="4 - Indexing Queue"
Ciao.
Giuseppe
hi @VijaySrrie
yes from Internal logs you can check for blocking queues , especially from metrics.log
1. you can check blocked quques from Monioting Console
Indexing->Performance->Indexing Performance : Instance.
2. from CLI uisng metrics.log
more metrics.log | grep -i name=typingqueue
you can look for blocked=true messages
FYI Queue Order
1.parsingQueue
2.aggQueue/merginig
3.typingQueue
4.indexQueue