On my 3 indexers(which are in a cluster), sometimes the **typing queue** and **indexing queue** go almost full ( >90% or 100%) -
and those indexers indexing rate will go down(e.g. 300KB/sec | normal case it will be >3MB/sec) -
and after I restart all my indexers' splunk service it will be back to normal (means the indexing rate will be improved., queue get cleared. etc.)
How does the restart of splunk service actually improve the performance back in this case?
- Does the restart of indexers actually indexed the data in the queue (which was full) ? **(without data loss)**
- Or it has cleared the queue ( wiped away / not indexed / removed from being indexed) and this improves the indexing rate for new incoming logs? **( with data loss)**
Is it recommended to restart the indexers (rolling-restart) when the queue/pipelines full ?
Thanks.
↧
Effect of restarting splunk service on indexers when the indexing pipelines/queues are almost full
↧