A customer has a number of inefficient regex replacement transforms being applied. When under heavy load the indexers are struggling to maintain the expected indexing rate. In a worst case scenario, which queue(s) would be expected to fill up?
A customer has a number of inefficient regex replacement transforms being applied. When under heavy load the indexers are struggling to maintain the expected indexing rate. In a worst case scenario, which queue(s) would be expected to fill up?
When regex replacement transforms become inefficient, they are typically processed during the typing phase of the indexing pipeline. Under heavy load, if the indexers are struggling to maintain the expected indexing rate due to these inefficient replacements, the Typing queue is the main queue affected since this is where the regex processing occurs. Consequently, in a worst-case scenario, the Typing queue would be expected to fill up.
C is correct https://wiki.splunk.com/Community:HowIndexingWorks
If indexers are slogging because of a blockage in the Typing pipeline, then worst-case scenario means Typing, Merging, Parsing, and Input queues would soon be filling up, while the Indexing queue would be practically empty.
I think it's A. A regex problem would cause the Typing queue to fill up first (answer C) BUT if this is a worst-case scenario then every queue before that (Parsing and Merging) would also get blocked. So it has to be more than just the Typing queue, and A is the only other one that fits. I'm assuming that when they say 'input', they mean that the forwarders would also not be able to send any more data to the Indexers so their queues would fill up as well
C is correct
C, this is a tricky question. Indexing would not fill up because nothing would make it past the typing queue and input is not a queue. So therefore, the only logical answer is C.
C is correct, refer https://wiki.splunk.com/Community:HowIndexingWorks typing pipeline
Agreed this is C