Back to Floor
Performance & Tuning • Room 3
Indexing Performance
Splunk ingestion passes through a pipeline of queues: Parsing → Merging → Typing → Indexing. If any queue fills up (`blocked=true` in metrics.log), it creates a bottleneck.
The `parallelIngestionPipelines` setting in `server.conf` can double throughput by running two parallel pipelines on a single indexer, critical for high-volume environments.
Knowledge Check
Prove your understanding to clear the room (Rewards XP)
Check for pipeline queue blocks: `index=_internal source=*metrics.log group=queue | where blocked=true`.
Splunk Search Bar
>