Splunk Search

Multiple Blocked Queues on Multiple Hosts

wwhite12
Path Finder

I run the query below every so often to see if there are any blocked queues and most of the time I see results when I run the query, the type of queues that are blocked sometimes include: indexqueue, typingqueue, structuredparsingqueue, aeq, parsingqueue, splunktcpin, aggqueue, auditqueue, and nullqueue.
Is there a reason that there is always some sort of queue that is being blocked and is there a particular queue that if blocked can have serious negative effects? Also any documentation on what each queue is meant for could also be helpful.

index=_internal group=queue | eval percfull=((current_size_kb/max_size_kb)*100) | search percfull>80 blocked=true | dedup host, name | table _time host name current_size_kb max_size_kb

Thanks in advance

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The common cause of unhealthy queues is slow disk I/O rates. Very complicated regex strings can also slow the indexer and cause queues to back up.
See https://docs.splunk.com/Documentation/Splunk/8.0.3/Troubleshooting/Troubleshootindexingperformance, https://docs.splunk.com/Splexicon, and https://docs.splunk.com/Documentation/Splunk/8.0.3/DMC/IndexingDeployment for some helpful information.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...