What do do about blocked messages...

[a212830]

I noticed a lot of "blocked" messages coming from one of my HFW today, and unsure what to do about it. The HFW in question processes a lot of netflow and stream events.

5/15/18 05-15-2018 18:27:23.109 +0000 INFO Metrics - group=queue, name=httpin,
6.27.23.109 PM host = bos-flow01 source = /opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =truef max_size_kb=500, current_size_kb=499, current_size=1234, largest_size=1237, smallest_size=0
5/15/18 05-15-2018 18:27:23.109 +0000 INFO Metrics - group=queue, name=httpin,
6.27.23.109 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1234, largest_size=1237, smallest_size=0
5/15/18 05-15-2018 18:26:52.108 +0000 INFO Metrics - group=queue, name=typingqueue,
6.26.52.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1234, largest_size=1262, smallest_size=199
5/15/18 05-15-2018 18:26:52.108 +0000 INFO Metrics - group=queue, name=httpin,
6.26.52.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1350, smallest_size=0
5/15/18 05-15-2018 18:26:52.108 +0000 INFO Metrics - group=queue, name=typingqueue,
6.26.52.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1234, largest_size=1262, smallest_size=199
5/15/18 05-15-2018 18:26:52.108 +0000 INFO Metrics - group=queue, name=httpin,
6.26.52.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1350, smallest_size=0
5/15/18 05-15-2018 18:26:21.108 +0000 INFO Metrics - group=queue, name=typingqueue,
6.26.21.108 PM host = bos-flow01 source = /opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1243, smallest_size=250
5/15/18 05-15-2018 18:26:21.108 +0000 INFO Metrics - group=queue, name=typingqueue,
6.26.21.108 PM host = bos-flow01 source = /opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1243, smallest_size=250
5/15/18 05-15-2018 18:25:50.108 +0000 INFO Metrics - group=queue, name=indexqueue, b
6.25.50.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
locked= true, max_size_kb=500, current_size_kb=499, current_size=1160, largest_size=1291, smallest_size=175
5/15/18 05-15-2018 18:25:50.108 +0000 INFO Metrics - group=queue, name=httpin,
6.25.50.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1232, largest_size=1293, smallest_size=0
5/15/18 05-15-2018 18:25:50.108 +0000 INFO Metrics - group=queue, name=indexqueue, b
6.25.50.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
locked= true, max_size_kb=500, current_size_kb=499, current_size=1160, largest_size=1291, smallest_size=175
5/15/18 05-15-2018 18:25:50.108 +0000 INFO Metrics - group=queue, name=httpin,
6.25.50.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1232, largest_size=1293, smallest_size=0
5/15/18 05-15-2018 18:25:19.108 +0000 INFO Metrics - group=queue, name=typingqueue,
6.25.19.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1241, smallest_size=0
5/15/18 05-15-2018 18:25:19.108 +0000 INFO Metrics - group=queue, name=httpin,
6.25.19.108 PM host = bos-flow01 source =/opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1238, smallest_size=0
5/15/18 05-15-2018 18:25:19.108 +0000 INFO Metrics - group=queue, name=typingqueue,
6.25.19.108 PM host = bos-flow01 source = /opt/splunk/var/log/splunk/metrics.log sourcetype = splunkd
blocked =true, max_size_kb=500, current_size_kb=499, current_size=1233, largest_size=1241, smallest_size=0

[somesoni2]

Have a look at this
https://answers.splunk.com/answers/168882/how-to-troubleshoot-blocked-queues-that-are-preven.html