Splunk 4.1.6 - skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block

[inquen]

How would I resolve an issue like this? There appears to be ample disk space on the server hosting the Splunk installation.

[k_harini]

How was this resolved? Please help

[rachelneal]

I am having the exact same problem and have ample disk space as well. I do find a lot of "blocked=true" in the metrics log but not sure how to remedy. what ended up working?

[chicodeme]

What did it end up being?

[jbsplunk · Accepted solution]

It probably means something is going on with the queues sending data through Splunk. I would check metrics.log for messages that show 'blocked=true'. Disk space could be part of the reason you'd run into this issue, but its sort of a generic 'things aren't healthy' message.