Getting Data In

How do we know whether typing queues are blocked or not?

vijaysri
Builder

Hi All,

How do we know whether typing queues are blocked or not?

Is it from Internal logs?

From the backend of the server, is it possible to find the queue blocks?

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @vijaysri,

you can find blocked queues is MOnitoring Console at [Settings -- Monitoring Console -- Indexing -- Indexing Performance: Instance]

or running a search like this

index=_internal blocked=true 
| stats count BY host

or this:

index=_internal  source=*metrics.log sourcetype=splunkd group=queue 
| eval name=case(name=="aggqueue","2 - Aggregation Queue",
 name=="indexqueue", "4 - Indexing Queue",
 name=="parsingqueue", "1 - Parsing Queue",
 name=="typingqueue", "3 - Typing Queue",
 name=="splunktcpin", "0 - TCP In Queue",
 name=="tcpin_cooked_pqueue", "0 - TCP In Queue") 
| eval max=if(isnotnull(max_size_kb),max_size_kb,max_size) 
| eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size) 
| eval fill_perc=round((curr/max)*100,2) 
| bin _time span=1m
| stats Median(fill_perc) AS "fill_percentage" by host, _time, name 
| where (fill_percentage>70 AND name!="4 - Indexing Queue") OR (fill_percentage>70 AND name="4 - Indexing Queue"

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @vijaysri,

you can find blocked queues is MOnitoring Console at [Settings -- Monitoring Console -- Indexing -- Indexing Performance: Instance]

or running a search like this

index=_internal blocked=true 
| stats count BY host

or this:

index=_internal  source=*metrics.log sourcetype=splunkd group=queue 
| eval name=case(name=="aggqueue","2 - Aggregation Queue",
 name=="indexqueue", "4 - Indexing Queue",
 name=="parsingqueue", "1 - Parsing Queue",
 name=="typingqueue", "3 - Typing Queue",
 name=="splunktcpin", "0 - TCP In Queue",
 name=="tcpin_cooked_pqueue", "0 - TCP In Queue") 
| eval max=if(isnotnull(max_size_kb),max_size_kb,max_size) 
| eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size) 
| eval fill_perc=round((curr/max)*100,2) 
| bin _time span=1m
| stats Median(fill_perc) AS "fill_percentage" by host, _time, name 
| where (fill_percentage>70 AND name!="4 - Indexing Queue") OR (fill_percentage>70 AND name="4 - Indexing Queue"

Ciao.

Giuseppe

SanjayReddy
Builder

 

hi @vijaysri 

yes from Internal logs you can check for blocking queues , especially from metrics.log  

1. you can check blocked quques from  Monioting Console 

Indexing->Performance->Indexing Performance : Instance.

2. from CLI uisng metrics.log  

more metrics.log | grep -i name=typingqueue

you can look for blocked=true messages 

FYI Queue Order 

1.parsingQueue
2.aggQueue/merginig
3.typingQueue
4.indexQueue

----
Thanks and Regards,
Sanjay Reddy
----
If this reply helps you, Karma would be appreciated.

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...