Logs stopped from one of the server

[asharmaeqfx]

Hi Splunkers,

I am facing a strange issue like the splunk forwarder stopped forwarding data. I see the forwarder is working fine and as per the splunk logs I see

The monitor input cannot produce data because splunkd's processing queues are full. This will be caused by inadequate indexing or forwarding rate, or a sudden burst of incoming data

I tried restarting the indexers and forwarder. It works for a while and after that it stops. 

Could you please advice.

Thanks,
Amit

[asharmaeqfx]

Hi All,

Thanks for your kind replies.

I have to delete some big logs and after that restarted the Splunk forwarder. It has been working since Friday.

As per your suggestion i think it was because the amount of logs which were being forwarded seems to be quite big and did not allow it to be forwarder and queues were getting full.

Regards,

Amit

[scelikok]

Hi @asharmaeqfx,

You can search in indexer's internal log for "The index processor has paused data flow". This log will show you the reason why it does not accept data. It may be a free disk space problem too.

[vamshiangothu · Accepted solution]

Hi,

check the following 

1. check your splunk forwarder version in server

2. check if firewall opened for the server

3. check the sever record in splunk forwarder management(splunk web-settings-forwarder management)

4. if splunk forwarder service is stopped in server. Please restart the service by running services.msc in command prompt

it will help you.