Splunk Search

Typing and Index queue shows 100%

mavilla
Explorer

I have noticed that Splunk is running relatively slow as of recently and found that the typing queue and indexing queue are both at 100% what is that cause of this and how do you remediate this?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The typing queue is full because the indexing queue is full. The index queue is full because the disk holding the indexes is too slow. The remaining indexer queues will fill up unless the I/O problem is corrected.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The typing queue is full because the indexing queue is full. The index queue is full because the disk holding the indexes is too slow. The remaining indexer queues will fill up unless the I/O problem is corrected.

---
If this reply helps you, Karma would be appreciated.

mavilla
Explorer

Thank you for your reply, as a follow up: is there a certain baseline or percentage that would be an ideal number for both? e.g. 50% 40% etc?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The ideal number is zero.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...