Indexes Overloaded?

[Dark_Ichigo]

Im currently indexing large amount of data and monitoring the process and usage from the Deployment Monitor.

For some reason the Deployment Monitor is marking the current status of the indexing as "Overloaded"

I found some information on SplunkBase : http://docs.splunk.com/Documentation/Splunk/4.2/Deploy/Troubleshootyourdeployment

Referring that this current indexing state could cause search performance issues after indexing, is this a risk, should I re-index?

[Dark_Ichigo]

I ran the following search during to Check Indexing queues during problem time frames:

"index=_internal source="metrics.log" group=queue | timechart perc95(current_size) by name"

but there doesnt seem to be any issues with the indexing queues, unless I'm missing something.

[mzorzi · Accepted solution]

I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.