Performance & Tuning • Room 3

Indexing Performance

Splunk ingestion passes through a pipeline of queues: Parsing → Merging → Typing → Indexing. If any queue fills up (`blocked=true` in metrics.log), it creates a bottleneck.

The `parallelIngestionPipelines` setting in `server.conf` can double throughput by running two parallel pipelines on a single indexer, critical for high-volume environments.

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Check for pipeline queue blocks: `index=_internal source=*metrics.log group=queue | where blocked=true`.

Splunk Search Bar