Deployment Architecture

Could not send data to output queue (parsingQueue) and also logs getting delay

shaikhussain2
Explorer

Hi Team,

we are recieving error like "Could not send data to output queue (parsingQueue), retrying..." in splunkd log (universal forwarder) and recieving error like "Blocked=True" in indexers.
And my indexing queue is getting almost full, do we have any way to resolve this issue.

ENVIRONMENT= 3 INDEXERS(clustering)(WINDOWS) WITH 16 CORE AND 64 gb memory , 520 GB LICENSE
CLIENT= RHEL 7.5

0 Karma

vegerlandecs
Explorer

This message is telling you that queue is full.
If you increase the parsing queue it will take more memory but will handle a bit better the events before sending them through. That alone, however, may not fix the problem, since the reason why it's it's likely to be the throughput (network) in limits.conf, which is 256 kbps by default.

input flow > output flow = queueing -> delay

In a more constant flow case, it's easy to predict queueing, problem is calculating quality of service when it has surges (for context: https://en.wikipedia.org/wiki/Queueing_theory)

How to increase thruput: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Limitsconf#.5Bthruput.5D

parsing queue can be changed to something like this (server.conf):

[queue=parsingQueue]
maxSize = 2MB

Edit: forgot to add that if your indexers are rejecting inputs, you need to increase capacity, either by changing to high speed disks or adding new indexers depending on where the bottleneck is - I suggest comparing queueing graphs to disk/cpu utilisation on the indexers.
There may be ways to workaround it before you add capacity, like playing with queues and etc. However, I'm afraid that it will be best if you engage support directly in this case.

0 Karma

ridwanahmed
Path Finder

Is there a reason (beyond the obvious complaint in the log) to use parsingQueue instead of:

    [queue]
    maxSize = 2MB
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...