Getting Data In

Heavy Forwarder parsing error, CPU 100% utilized



I have heavy forwarders which do the complete parsing in my setup but I see below errors in the splunkd.log and they error appears continuously:

01-15-2015 03:10:20.649 -0600 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
01-15-2015 03:10:25.649 -0600 INFO TailingProcessor - ...continuing

The CPU is also 100% utilized on 10/24 cores which is bad, because other processes are being hampered.

Any suggestions??

0 Karma


there could be more data coming and parsing queue is full

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!