Could not send data to output queue (parsingQueue) and also logs getting delay

[shaikhussain2]

Hi Team,

we are recieving error like "Could not send data to output queue (parsingQueue), retrying..." in splunkd log (universal forwarder) and recieving error like "Blocked=True" in indexers.
And my indexing queue is getting almost full, do we have any way to resolve this issue.

ENVIRONMENT= 3 INDEXERS(clustering)(WINDOWS) WITH 16 CORE AND 64 gb memory , 520 GB LICENSE
CLIENT= RHEL 7.5

[vegerlandecs]

This message is telling you that queue is full.
If you increase the parsing queue it will take more memory but will handle a bit better the events before sending them through. That alone, however, may not fix the problem, since the reason why it's it's likely to be the throughput (network) in limits.conf, which is 256 kbps by default.

input flow > output flow = queueing -> delay

In a more constant flow case, it's easy to predict queueing, problem is calculating quality of service when it has surges (for context: https://en.wikipedia.org/wiki/Queueing_theory)

How to increase thruput: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Limitsconf#.5Bthruput.5D

parsing queue can be changed to something like this (server.conf):

[queue=parsingQueue]
maxSize = 2MB

Edit: forgot to add that if your indexers are rejecting inputs, you need to increase capacity, either by changing to high speed disks or adding new indexers depending on where the bottleneck is - I suggest comparing queueing graphs to disk/cpu utilisation on the indexers.
There may be ways to workaround it before you add capacity, like playing with queues and etc. However, I'm afraid that it will be best if you engage support directly in this case.

[ridwanahmed]

Is there a reason (beyond the obvious complaint in the log) to use parsingQueue instead of:

    [queue]
    maxSize = 2MB