Splunk Search

Typing and Index queue shows 100%

mavilla
Explorer

I have noticed that Splunk is running relatively slow as of recently and found that the typing queue and indexing queue are both at 100% what is that cause of this and how do you remediate this?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The typing queue is full because the indexing queue is full. The index queue is full because the disk holding the indexes is too slow. The remaining indexer queues will fill up unless the I/O problem is corrected.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The typing queue is full because the indexing queue is full. The index queue is full because the disk holding the indexes is too slow. The remaining indexer queues will fill up unless the I/O problem is corrected.

---
If this reply helps you, Karma would be appreciated.

mavilla
Explorer

Thank you for your reply, as a follow up: is there a certain baseline or percentage that would be an ideal number for both? e.g. 50% 40% etc?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The ideal number is zero.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...