topic Logs stopped from one of the server in Getting Data In

Logs stopped from one of the server

asharmaeqfx — Fri, 29 Jan 2021 04:38:14 GMT

Hi Splunkers,

I am facing a strange issue like the splunk forwarder stopped forwarding data. I see the forwarder is working fine and as per the splunk logs I see

The monitor input cannot produce data because splunkd's processing queues are full. This will be caused by inadequate indexing or forwarding rate, or a sudden burst of incoming data

I tried restarting the indexers and forwarder. It works for a while and after that it stops.

Could you please advice.

Thanks,
Amit

Re: Logs stopped from one of the server

vamshiangothu — Fri, 29 Jan 2021 05:30:34 GMT

Hi,

check the following

1. check your splunk forwarder version in server

2. check if firewall opened for the server

3. check the sever record in splunk forwarder management(splunk web-settings-forwarder management)

4. if splunk forwarder service is stopped in server. Please restart the service by running services.msc in command prompt

it will help you.

Re: Logs stopped from one of the server

scelikok — Fri, 29 Jan 2021 05:52:53 GMT

Hi @asharmaeqfx,

You can search in indexer's internal log for "The index processor has paused data flow". This log will show you the reason why it does not accept data. It may be a free disk space problem too.

Re: Logs stopped from one of the server

asharmaeqfx — Mon, 01 Feb 2021 00:53:43 GMT

Hi All,

Thanks for your kind replies.

I have to delete some big logs and after that restarted the Splunk forwarder. It has been working since Friday.

As per your suggestion i think it was because the amount of logs which were being forwarded seems to be quite big and did not allow it to be forwarder and queues were getting full.

Regards,

Amit