Is there any search to find out whether indexer queues were blocked at a particular period of time? With Distributed Management Console (DMC), it shows only indexers queues which were full in last 15 minutes. For example, i want to know which indexer queues were full in past 2 hrs but this not possible with DMC.
How about this
index=_internal sourcetype=splunkd source=*metrics.log group=queue blocked=true
@kteng2024 - Did the answer provided by somesoni2 help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!
How about this
index=_internal sourcetype=splunkd source=*metrics.log group=queue blocked=true