Deployment Architecture

Splunk index congestion is happening

sravani387
New Member

Hi,
I suddenly got this message "skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block"
I am not able to index data can anyone suggest me how to solve this.

Tags (1)
0 Karma

ddrillic
Ultra Champion

A good response for this case at indexing congestion consistenly happening

It says -

alt text

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Did you check indexer disk space?
Assuming that's fine, continue with the distributed management console to see if you actually have indexer congestion or if your forwarder/search head is just confused.
If everything's showing as blocked in DMC, check for relevant error messages on the indexers.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...