Getting Data In

Indexes Overloaded?

Builder

Im currently indexing large amount of data and monitoring the process and usage from the Deployment Monitor.

For some reason the Deployment Monitor is marking the current status of the indexing as "Overloaded"

I found some information on SplunkBase : http://docs.splunk.com/Documentation/Splunk/4.2/Deploy/Troubleshootyourdeployment

Referring that this current indexing state could cause search performance issues after indexing, is this a risk, should I re-index?

Tags (3)
1 Solution

Splunk Employee
Splunk Employee

I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.

View solution in original post

Builder

I ran the following search during to Check Indexing queues during problem time frames:

"index=internal source="metrics.log" group=queue | timechart perc95(currentsize) by name"

but there doesnt seem to be any issues with the indexing queues, unless I'm missing something.

0 Karma

Splunk Employee
Splunk Employee

I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.

View solution in original post