Heavy Forwarder parsing error, CPU 100% utilized

meenal901 · ‎01-15-2015

Hi,

I have heavy forwarders which do the complete parsing in my setup but I see below errors in the splunkd.log and they error appears continuously:

01-15-2015 03:10:20.649 -0600 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
01-15-2015 03:10:25.649 -0600 INFO TailingProcessor - ...continuing

The CPU is also 100% utilized on 10/24 cores which is bad, because other processes are being hampered.

Any suggestions??

kml_uvce · ‎01-16-2015

there could be more data coming and parsing queue is full

kamal singh bisht

Heavy Forwarder parsing error, CPU 100% utilized

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Index This | What travels the world but is also stuck in place?

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

Join the Conversation

Heavy Forwarder parsing error, CPU 100% utilized

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Index This | What travels the world but is also stuck in place?

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...