Getting Data In

Could not send data to parsing queue

siddharthmis
Explorer

I have following in the logs-

INFO  TailReader - Could not send data to output queue (parsingQueue), retrying...
INFO  TailReader -   ...continuing.

On checking the metrics.log, I can see it reads-

INFO  Metrics - group=queue, name=parsingqueue, blocked=true, max_size_kb=512, current_size_kb=511

So, the problem is likely on the indexing side only - perhaps the indexing box is overloaded.

Any idea what can be done to fix this?

0 Karma

p_gurav
Champion

Hi siddharthmis,

Can you check monitoring console and also how many files server is monitoring?

0 Karma

siddharthmis
Explorer

Hi,

Sorry for the late reply. The server indeed monitors huge number of log files.
I increased the maxSize limit to a higher value in server.conf at the location ...\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\ and it helped.

0 Karma

p_gurav
Champion

Hi ,

Good it got resolved. But its always best practice to change configuration in "local" directory instead "default". 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...