https://community.splunk.com/t5/Getting-Data-In/Where-do-I-start-with-troubleshooting-Parsing-Queue-issues-on-a/m-p/447070#M77772 <P>You should start looking for </P> <PRE><CODE>index=_internal component=metrics name=parsingQueue WARN OR ERROR </CODE></PRE> Wed, 14 Aug 2019 19:14:12 GMT mayurr98 2019-08-14T19:14:12Z https://community.splunk.com/t5/Getting-Data-In/Where-do-I-start-with-troubleshooting-Parsing-Queue-issues-on-a/m-p/447069#M77771 <P>All, </P> <P>I have SplunkAdmins app installed and received alerts showing me that my Universal Forwarder on a series of Windows servers are having their "1 - Parsing Queue" backup pretty often. I don't have much installed there except Splunk_TA_windows. Point me to any good docs on troubleshooting Parsing Queue backups on the UF itself?</P> <P>thanks<BR /> -Daniel </P> Wed, 30 Sep 2020 01:44:12 GMT https://community.splunk.com/t5/Getting-Data-In/Where-do-I-start-with-troubleshooting-Parsing-Queue-issues-on-a/m-p/447069#M77771 daniel333 2020-09-30T01:44:12Z https://community.splunk.com/t5/Getting-Data-In/Where-do-I-start-with-troubleshooting-Parsing-Queue-issues-on-a/m-p/447070#M77772 <P>You should start looking for </P> <PRE><CODE>index=_internal component=metrics name=parsingQueue WARN OR ERROR </CODE></PRE> Wed, 14 Aug 2019 19:14:12 GMT https://community.splunk.com/t5/Getting-Data-In/Where-do-I-start-with-troubleshooting-Parsing-Queue-issues-on-a/m-p/447070#M77772 mayurr98 2019-08-14T19:14:12Z https://community.splunk.com/t5/Getting-Data-In/Where-do-I-start-with-troubleshooting-Parsing-Queue-issues-on-a/m-p/447071#M77773 <P>The UF does not have a parsing queue. The error message you cite is part of the "Indexer Queues May Have Issues" alert so I suspect your configuration has mixed up indexer and UF host names. Check the setting for the indexerhosts macro.</P> Wed, 14 Aug 2019 19:18:04 GMT https://community.splunk.com/t5/Getting-Data-In/Where-do-I-start-with-troubleshooting-Parsing-Queue-issues-on-a/m-p/447071#M77773 richgalloway 2019-08-14T19:18:04Z https://community.splunk.com/t5/Getting-Data-In/Where-do-I-start-with-troubleshooting-Parsing-Queue-issues-on-a/m-p/447072#M77774 <P>Tracked down the problem on the UF's parsing queue to basically a limits.conf setting on KB per second. Needed closer to 1 meg per second from these hosts and had it set to 512. Once I tuned that the queue alerts went away. </P> Thu, 15 Aug 2019 16:48:21 GMT https://community.splunk.com/t5/Getting-Data-In/Where-do-I-start-with-troubleshooting-Parsing-Queue-issues-on-a/m-p/447072#M77774 daniel333 2019-08-15T16:48:21Z