Splunk Enterprise

Why do I have blocked queue messages but my DMC doesn't show queues as full?



I'm noticing a fair amount of blocked queues in my internal logs, especially for the exec queue. However, when I look at the DMC, and the indexer in question, those queues are not anywhere near 100%, even when showing maximum values. Am I misunderstanding something?

0 Karma


Do you have the monitoring console set to median or maximum for queue sizes? Set it to maximum and see if it is sometimes blocked but clears itself quickly...

0 Karma

Splunk Employee
Splunk Employee

Screenshot or it didn't happen 😉

I'm wondering if there's flutters of such queue messages but nothing happening a majority of the time and therefore not really a problem.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...