Typing and Index queue shows 100%

[mavilla]

I have noticed that Splunk is running relatively slow as of recently and found that the typing queue and indexing queue are both at 100% what is that cause of this and how do you remediate this?

[richgalloway · Accepted solution]

The typing queue is full because the indexing queue is full. The index queue is full because the disk holding the indexes is too slow. The remaining indexer queues will fill up unless the I/O problem is corrected.

[mavilla]

Thank you for your reply, as a follow up: is there a certain baseline or percentage that would be an ideal number for both? e.g. 50% 40% etc?

[richgalloway]

The ideal number is zero.