https://community.splunk.com/t5/Getting-Data-In/New-Install-TailingProcessor-Could-not-send-data-to-output-queue/m-p/94325#M19622 <P>After installing Splunk on a new node as a LightWeightForwarder and configuring for the local logs I wanted to monitor I started seeing the following messages in the splunkd.log:</P> <P>TailingProcessor - Could not send data to output queue (parsingQueue), retrying…</P> <P>These messages only occurred after I added the file monitors, it had run overnight with just the unix application without issue.</P> Thu, 25 Nov 2010 02:49:27 GMT mikelanghorst 2010-11-25T02:49:27Z https://community.splunk.com/t5/Getting-Data-In/New-Install-TailingProcessor-Could-not-send-data-to-output-queue/m-p/94325#M19622 <P>After installing Splunk on a new node as a LightWeightForwarder and configuring for the local logs I wanted to monitor I started seeing the following messages in the splunkd.log:</P> <P>TailingProcessor - Could not send data to output queue (parsingQueue), retrying…</P> <P>These messages only occurred after I added the file monitors, it had run overnight with just the unix application without issue.</P> Thu, 25 Nov 2010 02:49:27 GMT https://community.splunk.com/t5/Getting-Data-In/New-Install-TailingProcessor-Could-not-send-data-to-output-queue/m-p/94325#M19622 mikelanghorst 2010-11-25T02:49:27Z https://community.splunk.com/t5/Getting-Data-In/New-Install-TailingProcessor-Could-not-send-data-to-output-queue/m-p/94326#M19623 <P>I realized after seeing this message that I hadn't manually inspected the directories the monitors were looking at. I had over 1000 old webserver logs that I was telling splunk to forward over to the indexer, causing it to backup with the maxKBps setting by default.</P> <P>I chose to cleanout the old files to reduce what i was indexing, but altering the maxKBps would work as well to help clear out the backlog. <A href="http://answers.splunk.com/questions/7750/increase-throughput-limit-on-a-lightweight-forwarder" rel="nofollow">http://answers.splunk.com/questions/7750/increase-throughput-limit-on-a-lightweight-forwarder</A></P> <P>Chatting about it on IRC, this may be a common issue on cold installs.</P> Thu, 25 Nov 2010 02:54:05 GMT https://community.splunk.com/t5/Getting-Data-In/New-Install-TailingProcessor-Could-not-send-data-to-output-queue/m-p/94326#M19623 mikelanghorst 2010-11-25T02:54:05Z