Splunk® Enterprise

Admin Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Indexing performance: Instance

What does this view show?

Several panels about indexing performance on one instance of the potentially several in your deployment.

Interpret results in this view

The snapshot panel called Splunk Enterprise Data Pipeline exposes decaying averages for queue sizes. The averages use data over the previous 15 minutes. This panel, along with the historical panel Median Fill Ratio of Data Processing Queues, helps you narrow down sources of indexing latency to a specific queue. Data starts at parsing and travels through the data pipeline to indexing at the end.

The Aggregate CPU Seconds Spent per Indexer Processor Activity panel lets you "Split index service by subtask." The several index services are subtasks related to preparing for and cleaning up after indexing. For more information about the meaning of subtask categories, see the metrics.log topic in the Troubleshooting Manual.

What to look out for in this view

The Splunk Enterprise Data Pipeline panel, along with the historical panel Median Fill Ratio of Data Processing Queues, helps you narrow down sources of indexing latency to a specific queue. Data starts at parsing and travels through the data pipeline to indexing at the end. Here is an example of the panel in an instance with unhealthy queues:

Cloggedpipeline.png

In this example, although the parsing and aggregator queues have very high fill ratios, the problem is likely to be with processes in the typing queue. The typing queue is the first one that slows down, and data is backing up into the other two queues while waiting to get into the typing queue.

Troubleshoot this view

The snapshot panels get data from Splunk REST endpoints for introspection. If snapshot panels lack data, check the system requirements for platform instrumentation.

The historical panels for this view get data from metrics.log.

PREVIOUS
Platform alerts
  NEXT
Indexing performance: Deployment

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters