Audit event generator: Now skipping indexing of internal audit events, because the downstream queue is not accepting data. Will keep dropping events until data flow resumes

[ankitcharolia09]

I see warning message in splunk master node.

"Audit event generator: Now skipping indexing of internal audit events, because the downstream queue is not accepting data. Will keep dropping events until data flow resumes. Review system health: ensure downstream indexing and/or forwarding are operating correctly."

Please help me to fix this.

Thank you

[saurabh_tek11]

Hi @ankitcharolia09, please check - apparently your Splunk instance is forwarding to itself.
Check on the indexer: Is a receiving port set? [okay]
Is the indexer forwarding? Where? If it is forwarding to itself, then that's the problem!
You can find both of these settings in the UI under Settings>>Forwarding and Receiving
Or, you can find the receiving settings in inputs.conf and the forwarding settings in outputs.conf
Please accept this answer, it this pointed you in right direction.

[fabiocaldas]

Thanks it was very easy to solve the problem after reading your answer.

[saurabh_tek11]

@fabiocaldas Great to hear that. IF this pointed you in right direction to fix the issue, please accept my answer.

[lmorillogonzazl]

How is this problem solved?

[saurabh_tek11]

This error comes when Splunk instance is forwarding logs to itself.