SPL to identify UFs needed to increase pipeline sets

[jaracan]

Hi All,

We are planning to configure some of our universal forwarders to use multiple pipeline sets. Do you have some sort of SPL that we can use to identify which forwarders have blocking queues and needs to increase the number of pipeline set.

[richgalloway]

When a queue is blocked it's usually because something downstream is unable to keep up with things.  Often that's either the network or the indexers.  In those cases, adding another pipeline to the UF will just make things worse.

Use the Monitoring Console to check the health of the indexers.  Treat what you find.

Increasing the maxKBps setting in the UF's limits.conf file may get things moving.

To see numbers, this query may help:

index=_internal component=Metrics group=queue