Getting Data In

Can you help me troubleshoot my issue involving sending data to output queue(parsing queue)?

ankithnageshshe
Path Finder

Hello Splunkers,

Lately, we have been facing issues in on-boarding data due to the “Could not send…..parsing queue full” issue whenever there is a data burst.

We have been setting maxkbps in limits.conf to unlimited(0) and parsing queue size to 10 MB from 512kb temporarily as a workaround.

What is the Splunk recommended best practice to address this issue?

Splunk universal forwarder version - 6.4

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @ankithnageshshetty,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

vinkumar_splunk
Splunk Employee
Splunk Employee

Check the below link:

https://answers.splunk.com/answers/5590/could-not-send-data-to-the-output-queue.html

Most cases this occur due to congestion on the indexer side. you need to look into the "QUEUES" and sort out based on which queue is filled.

For example, look for line breaking/truncating for parsing queue; dateparserververbose for aggregation queue, regex for typing queue and check the IOPS value ( random seeks ) if the indexing queue is filled, ensure that you have 800 IOPS value on the indexer.

DId the temporary workaround helped?

Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...