Getting Data In

Indexes Overloaded?

Dark_Ichigo
Builder

Im currently indexing large amount of data and monitoring the process and usage from the Deployment Monitor.

For some reason the Deployment Monitor is marking the current status of the indexing as "Overloaded"

I found some information on SplunkBase : http://docs.splunk.com/Documentation/Splunk/4.2/Deploy/Troubleshootyourdeployment

Referring that this current indexing state could cause search performance issues after indexing, is this a risk, should I re-index?

Tags (3)
1 Solution

mzorzi
Splunk Employee
Splunk Employee

I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.

View solution in original post

Dark_Ichigo
Builder

I ran the following search during to Check Indexing queues during problem time frames:

"index=_internal source="metrics.log" group=queue | timechart perc95(current_size) by name"

but there doesnt seem to be any issues with the indexing queues, unless I'm missing something.

0 Karma

mzorzi
Splunk Employee
Splunk Employee

I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.