Monitoring Splunk

What are some searches I can run to check out the current situation with my queues?

the_wolverine
Champion

I need some help with figuring out some potential blocked queues. What searches can be run to help me figure this out?

0 Karma
1 Solution

Mick
Splunk Employee
Splunk Employee
index=_internal source=*metrics.log group=queue | chart perc90(current_size) by name

Note: This will give you a table of queues by name. Take note of any queue sizes that are consistently greater than 500. By default, the queue size limit is 1000, so when a queue gets to that size, it is blocked and data-flow stops completely

View solution in original post

Mick
Splunk Employee
Splunk Employee
index=_internal source=*metrics.log group=queue | chart perc90(current_size) by name

Note: This will give you a table of queues by name. Take note of any queue sizes that are consistently greater than 500. By default, the queue size limit is 1000, so when a queue gets to that size, it is blocked and data-flow stops completely

Stephen_Sorkin
Splunk Employee
Splunk Employee

It's often better to use "timechart" instead of "chart" so that you can see when specific queues were filled.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...