Splunk Search

Multiple Blocked Queues on Multiple Hosts

wwhite12
Path Finder

I run the query below every so often to see if there are any blocked queues and most of the time I see results when I run the query, the type of queues that are blocked sometimes include: indexqueue, typingqueue, structuredparsingqueue, aeq, parsingqueue, splunktcpin, aggqueue, auditqueue, and nullqueue.
Is there a reason that there is always some sort of queue that is being blocked and is there a particular queue that if blocked can have serious negative effects? Also any documentation on what each queue is meant for could also be helpful.

index=_internal group=queue | eval percfull=((current_size_kb/max_size_kb)*100) | search percfull>80 blocked=true | dedup host, name | table _time host name current_size_kb max_size_kb

Thanks in advance

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The common cause of unhealthy queues is slow disk I/O rates. Very complicated regex strings can also slow the indexer and cause queues to back up.
See https://docs.splunk.com/Documentation/Splunk/8.0.3/Troubleshooting/Troubleshootindexingperformance, https://docs.splunk.com/Splexicon, and https://docs.splunk.com/Documentation/Splunk/8.0.3/DMC/IndexingDeployment for some helpful information.

---
If this reply helps you, an upvote would be appreciated.
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>