topic Re: How to fix this error in health? in Splunk Enterprise

How to fix this error in health?

Sandev — Wed, 30 Mar 2022 22:30:07 GMT

Ingestion Latency

Root Cause(s):
- Events from tracker.log have not been seen for the last 74130 seconds, which is more than the red threshold (210 seconds). This typically occurs when indexing or forwarding are falling behind or are blocked.

Re: New Splunk User got this error in health how to fix this

richgalloway — Sun, 06 Feb 2022 22:33:30 GMT

Others have reported that problem as well (but not me). See if this Answer helps.

https://community.splunk.com/t5/Splunk-Enterprise/Ingestion-Latency-after-updating-to-8-2-1/m-p/558579

Re: New Splunk User got this error in health how to fix this

phil__tanner — Wed, 30 Mar 2022 19:41:44 GMT

I'm also getting this after upgrading from 8.1.3 to 8.2.5 last night.

I have tried the mitigations in that linked post, unfortunately to no avail.

It's not stopped indexing, occasionally it'll catch up and the message disappears, but then over time it will build back up again, before the cycle repeats.

Any other ideas?

Re: New Splunk User got this error in health how to fix this

bvv — Sun, 10 Apr 2022 07:28:48 GMT

same here after upgrade from 7.2 > 8.1.3 > 8.2.5.

8.2.6 came out today hopefully it could be a fix but tried without luck.

in my situation searches aren't running at all.

Ingestion Latency and Search Scheduler Searches Skipped appear in red.

Re: New Splunk User got this error in health how to fix this

phil__tanner — Sun, 10 Apr 2022 23:43:04 GMT

That sounds identical to our upgrade route. Originally (7.2) on Ubuntu 18.04 (from an Azure pre-packaged Splunk image), then 8.1.3 & Ubuntu 20.04.

Re: How to fix this error in health?

jdcabanglan — Wed, 19 Oct 2022 08:08:28 GMT

Did someone knows how to fix it?

Re: How to fix this error in health?

thangbui — Wed, 26 Oct 2022 07:10:01 GMT

This is the problem I have. Has someone found a solution to this problem