Getting Data In
Highlighted

Splunk 4.1.6 - skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block

Engager

How would I resolve an issue like this? There appears to be ample disk space on the server hosting the Splunk installation.

Highlighted

Re: Splunk 4.1.6 - skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block

Splunk Employee
Splunk Employee

It probably means something is going on with the queues sending data through Splunk. I would check metrics.log for messages that show 'blocked=true'. Disk space could be part of the reason you'd run into this issue, but its sort of a generic 'things aren't healthy' message.

View solution in original post

Highlighted

Re: Splunk 4.1.6 - skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block

Communicator

What did it end up being?

0 Karma
Highlighted

Re: Splunk 4.1.6 - skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block

Path Finder

I am having the exact same problem and have ample disk space as well. I do find a lot of "blocked=true" in the metrics log but not sure how to remedy. what ended up working?

0 Karma
Highlighted

Re: Splunk 4.1.6 - skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block

Communicator

How was this resolved? Please help

0 Karma