Getting Data In

Indexes Overloaded?

Dark_Ichigo
Builder

Im currently indexing large amount of data and monitoring the process and usage from the Deployment Monitor.

For some reason the Deployment Monitor is marking the current status of the indexing as "Overloaded"

I found some information on SplunkBase : http://docs.splunk.com/Documentation/Splunk/4.2/Deploy/Troubleshootyourdeployment

Referring that this current indexing state could cause search performance issues after indexing, is this a risk, should I re-index?

Tags (3)
1 Solution

mzorzi
Splunk Employee
Splunk Employee

I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.

View solution in original post

Dark_Ichigo
Builder

I ran the following search during to Check Indexing queues during problem time frames:

"index=_internal source="metrics.log" group=queue | timechart perc95(current_size) by name"

but there doesnt seem to be any issues with the indexing queues, unless I'm missing something.

0 Karma

mzorzi
Splunk Employee
Splunk Employee

I think you should first consider to add another indexer. The search performance problems is caused by shortage of Cpu rather than wrong data format.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...