topic Re: Could not send data to parsing queue in Getting Data In

Could not send data to parsing queue

siddharthmis — Tue, 30 Jan 2018 10:21:31 GMT

I have following in the logs-

INFO  TailReader - Could not send data to output queue (parsingQueue), retrying...
INFO  TailReader -   ...continuing.

On checking the metrics.log, I can see it reads-

INFO  Metrics - group=queue, name=parsingqueue, blocked=true, max_size_kb=512, current_size_kb=511

So, the problem is likely on the indexing side only - perhaps the indexing box is overloaded.

Any idea what can be done to fix this?

Re: Could not send data to parsing queue

p_gurav — Tue, 30 Jan 2018 13:49:46 GMT

Hi siddharthmis,

Can you check monitoring console and also how many files server is monitoring?

Re: Could not send data to parsing queue

siddharthmis — Tue, 06 Feb 2018 05:07:32 GMT

Hi,

Sorry for the late reply. The server indeed monitors huge number of log files.
I increased the maxSize limit to a higher value in server.conf at the location ...\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\ and it helped.

Re: Could not send data to parsing queue

p_gurav — Tue, 06 Feb 2018 05:12:02 GMT

Hi ,

Good it got resolved. But its always best practice to change configuration in "local" directory instead "default". 🙂