Splunk Search

Typing and Index queue shows 100%

mavilla
Explorer

I have noticed that Splunk is running relatively slow as of recently and found that the typing queue and indexing queue are both at 100% what is that cause of this and how do you remediate this?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The typing queue is full because the indexing queue is full. The index queue is full because the disk holding the indexes is too slow. The remaining indexer queues will fill up unless the I/O problem is corrected.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The typing queue is full because the indexing queue is full. The index queue is full because the disk holding the indexes is too slow. The remaining indexer queues will fill up unless the I/O problem is corrected.

---
If this reply helps you, Karma would be appreciated.

mavilla
Explorer

Thank you for your reply, as a follow up: is there a certain baseline or percentage that would be an ideal number for both? e.g. 50% 40% etc?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The ideal number is zero.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...