Hi All,
We are facing issues where syslog server is storing Palo Alto logs in a directory and from Universal forwarder on the syslog server we are reading the logs.
Universal forwarder is not reading the logs and sending it to the indexer . Below is the warning shown in splunkd.log
Enqueuing a very large in the batch reader, reading of other large files could be delayed
Could anyone please help how to fix this issue.
Regards,
Samad
Are you also noticing the following messages in your splunkd.log along with the enqueuing very large file message?
INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
Also, what is your maxKBps settings in limits.conf on the Forwarder where you see this message? By default it is
$SPLUNK_HOME/etc/system/default/limits.conf
[thruput]
maxKBps=256
you can try increasing to 512 (double than default) or 0 (unlimited) in $SPLUNK_HOME/etc/system/local/limits.conf
[thruput]
maxKBps=512
Check out this article:
https://docs.splunk.com/Documentation/Splunk/7.2.0/Troubleshooting/Troubleshootingeventsindexingdela...
Are you also noticing the following messages in your splunkd.log along with the enqueuing very large file message?
INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
Also, what is your maxKBps settings in limits.conf on the Forwarder where you see this message? By default it is
$SPLUNK_HOME/etc/system/default/limits.conf
[thruput]
maxKBps=256
you can try increasing to 512 (double than default) or 0 (unlimited) in $SPLUNK_HOME/etc/system/local/limits.conf
[thruput]
maxKBps=512
Check out this article:
https://docs.splunk.com/Documentation/Splunk/7.2.0/Troubleshooting/Troubleshootingeventsindexingdela...
Hi, i added some stanza, and the newly added monitor files did not get indexed.
However, old files are still sending the data.