Can you help us with a data input problem?

[makhambayeva]

Splunk Enterprise is installed on server and received some data according to some port, but after some time some troubles occur. You can see this in attachments. How can we solve this?

[solarboyz1]

It appear the Splunk instance you are sending your data to is getting overloaded, it cannot keep up with the amount of incoming data.

My guess is you need more resources to keep up with the incoming data.

If this is intermittent when spikes of data occur, you may be able to increase your network queue sizes to hold more data. This may allow the queue to hold the data during a spike, provided the incoming data eventually decrease so the queues can be emptied.