Admin Manual

Indexing performance: Instance

What does this view show?

Several panels about indexing performance on one instance of the potentially several in your deployment.

Interpret results in this view

The snapshot panel called Splunk Enterprise Data Pipeline exposes decaying averages for queue sizes. The averages use data over the previous 15 minutes. This panel, along with the historical panel Median Fill Ratio of Data Processing Queues, helps you narrow down sources of indexing latency to a specific queue. Data starts at parsing and travels through the data pipeline to indexing at the end.

The Aggregate CPU Seconds Spent per Indexer Processor Activity panel lets you "Split index service by subtask." The several index services are subtasks related to preparing for and cleaning up after indexing. For more information about the meaning of subtask categories, see the metrics.log topic in the Troubleshooting Manual.

What to look out for in this view

The Splunk Enterprise Data Pipeline panel, along with the historical panel Median Fill Ratio of Data Processing Queues, helps you narrow down sources of indexing latency to a specific queue. Data starts at parsing and travels through the data pipeline to indexing at the end. Here is an example of the panel in an instance with unhealthy queues:

In this example, although the parsing and aggregator queues have very high fill ratios, the problem is likely to be with processes in the typing queue. The typing queue is the first one that slows down, and data is backing up into the other two queues while waiting to get into the typing queue.

Troubleshoot this view

The snapshot panels get data from Splunk REST endpoints for introspection. If snapshot panels lack data, check the system requirements for platform instrumentation.

The historical panels for this view get data from metrics.log.