- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
delayed logs
I have a problem with the logs, they are arriving with a delay of 12 hours or more
The information first reaches a syslog server and is forwarded to the indexers
When reviewing the logs in the syslog servers I find that they arrive without problem and with the correct date and time
when I go to the indexers or search heads to look at the logs I see that they have a delay of 12 hours or more
With this document I have tried to diagnose the problem but I cannot find the same panels that ask to review the document
in the part where it is suggested to check with the command iostat -zx 1 one of the parameters are in the values cataloged as bad
What else should I check?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

This is good starting point for looking this issue: https://conf.splunk.com/files/2019/slides/FN1570.pdf
r. Ismo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes, the syslog server receives the logs and forwards them to the indexers using UF
I understand that the cause of the queuing is typingqueue?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

What kind of disk you have and what is amount of your daily/peak indexing volume?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In a previous post you suggested that I check that it will have a minimum IOPS, after checking, the disk has more than 800, it even has double.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

