Getting Data In

Can you help me troubleshoot my issue involving sending data to output queue(parsing queue)?

ankithnageshshe
Path Finder

Hello Splunkers,

Lately, we have been facing issues in on-boarding data due to the “Could not send…..parsing queue full” issue whenever there is a data burst.

We have been setting maxkbps in limits.conf to unlimited(0) and parsing queue size to 10 MB from 512kb temporarily as a workaround.

What is the Splunk recommended best practice to address this issue?

Splunk universal forwarder version - 6.4

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @ankithnageshshetty,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

vinkumar_splunk
Splunk Employee
Splunk Employee

Check the below link:

https://answers.splunk.com/answers/5590/could-not-send-data-to-the-output-queue.html

Most cases this occur due to congestion on the indexer side. you need to look into the "QUEUES" and sort out based on which queue is filled.

For example, look for line breaking/truncating for parsing queue; dateparserververbose for aggregation queue, regex for typing queue and check the IOPS value ( random seeks ) if the indexing queue is filled, ensure that you have 800 IOPS value on the indexer.

DId the temporary workaround helped?

Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...