Splunk Enterprise

Why do I have blocked queue messages but my DMC doesn't show queues as full?



I'm noticing a fair amount of blocked queues in my internal logs, especially for the exec queue. However, when I look at the DMC, and the indexer in question, those queues are not anywhere near 100%, even when showing maximum values. Am I misunderstanding something?

0 Karma


Do you have the monitoring console set to median or maximum for queue sizes? Set it to maximum and see if it is sometimes blocked but clears itself quickly...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma

Ultra Champion

Screenshot or it didn't happen 😉

I'm wondering if there's flutters of such queue messages but nothing happening a majority of the time and therefore not really a problem.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!