Indexing performance: Instance
This topic is a reference for the Indexing performance: Instance dashboard in the distributed management console. See “About the distributed management console.”
What does this view show?
Several panels about indexing performance on one instance of the potentially several in your deployment.
Interpret results in this view
The snapshot panel called Splunk Enterprise Data Pipeline exposes decaying averages for queue sizes. The averages use data over the previous 15 minutes. This panel, along with the historical panel Median Fill Ratio of Data Processing Queues, helps you narrow down sources of indexing latency to a specific queue. Data starts at parsing and travels through the data pipeline to indexing at the end.
The Aggregate CPU Seconds Spent per Indexer Processor Activity panel lets you "Split index service by subtask." The several index services are subtasks related to preparing for and cleaning up after indexing. For more information about the meaning of subtask categories, see the metrics.log topic in the Troubleshooting Manual.
What to look out for in this view
The Splunk Enterprise Data Pipeline panel, along with the historical panel Median Fill Ratio of Data Processing Queues, helps you narrow down sources of indexing latency to a specific queue. Data starts at parsing and travels through the data pipeline to indexing at the end. Here is an example of the panel in an instance with unhealthy queues:
In this example, although the parsing and aggregator queues have very high fill ratios, the problem is likely to be with processes in the typing queue. The typing queue is the first one that slows down, and data is backing up into the other two queues while waiting to get into the typing queue.
Troubleshoot this view
The snapshot panels get data from Splunk REST endpoints for introspection.
If snapshot panels lack data, check
- the system requirements for platform instrumentation.
server.conf. When pipeline sets are used (that is, if
pipelinesetsis set to a value greater than 1), some panels in the DMC indexing performance dashboards will be blank.
The historical panels for this view get data from metrics.log.
Indexing performance: Deployment
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11