topic Re: Skipped Indexing in Getting Data In

Skipped Indexing

sleathley — Wed, 03 Nov 2010 01:33:07 GMT

What does this message mean and how does one resolve it. Has appeared now for several days. Using at best 1% of disk space.

skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block

Re: Skipped Indexing

rsimmons — Wed, 03 Nov 2010 01:48:11 GMT

Recommendation: Run the "splunk diag" utility, open a case and upload the diag file to your case, Splunk Support will provide you assistance.

Here are a few things to check, according to the url listed below:

Check disk space on all of your partitions. If your space is too low, then that will cause indexing and searching problems.
Verify that "splunk-optimize" has been running. If you see a large number of *.tsidx files in your buckets, you can simply run splunk-optimize /path/to/your/bucket to force this process to run.
Try disabling some non-essential scheduled saved searches and see if that helps relieve the problem. (You probably don't want to do this for summary-indexing saved searches, if it can be avoided.)

http://splunk-base.splunk.com/answers/7996/down-error-skipped-indexing-of-internal-audit-event-will-keep-dropping-events-until-indexer-congestion-is-remedied-check-disk-space-and-other-issues-that-may-cause-indexer-to-block

Re: Skipped Indexing

chicodeme — Thu, 20 Oct 2011 16:13:42 GMT

What did this end up being?

Re: Skipped Indexing

kphillipson — Wed, 28 Nov 2012 20:57:16 GMT

I had this problem while running 5.0 but I believe the root cause was due to forwarding syslog data from a forwarder on the same box as the search head to the indexer (this was due to a work around due to a syslog bug in 5.0).

Once I upgraded to 5.0.1 I had to fsch the database to keep this error for showing up. Stop splunk and run this command.

splunk fsck --all --repair

Re: Skipped Indexing

ITUser1 — Thu, 05 Mar 2015 15:21:38 GMT

In what folder set would I run this command on a Window indexer?