Splunk HF - Typing Queue full but CPU of the machine is low

[GaetanVP]

Hello Splunkers,

I am currently having parsing problems with my Splunk Heavy Forwarder.
I know I have heavy regex  that are causing Typing Queue problems, but I do not understand why "Splunk is not taking more CPU" on my machine (CPU is always around 10-15%)

Thanks a lot,

GaetanVP  

[gcusello · Accepted solution]

Hi @GaetanVP,

on Heavy Forwarder you can use parallel pipeline to optimize your CPU use.

here you can find indications for indexers, but it's the same for HFs: https://docs.splunk.com/Documentation/Splunk/9.0.3/Indexer/Pipelinesets

In few words, you have to put in [general] stanza of server.conf:

parallelIngestionPipelines = 2

You cannot put an higher value event if you have more CPUs.

Ciao.

Giuseppe