Getting Data In

Indexes Overloaded?

Dark_Ichigo
Builder

Im currently indexing large amount of data and monitoring the process and usage from the Deployment Monitor.

For some reason the Deployment Monitor is marking the current status of the indexing as "Overloaded"

I found some information on SplunkBase : http://docs.splunk.com/Documentation/Splunk/4.2/Deploy/Troubleshootyourdeployment

Referring that this current indexing state could cause search performance issues after indexing, is this a risk, should I re-index?

Tags (3)
1 Solution

mzorzi
Splunk Employee
Splunk Employee

I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.

View solution in original post

Dark_Ichigo
Builder

I ran the following search during to Check Indexing queues during problem time frames:

"index=_internal source="metrics.log" group=queue | timechart perc95(current_size) by name"

but there doesnt seem to be any issues with the indexing queues, unless I'm missing something.

0 Karma

mzorzi
Splunk Employee
Splunk Employee

I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!