Getting Data In
Highlighted

: skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block10

Path Finder

skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block10

Can anyone pls help how to ntroubleshoot

Tags (1)
0 Karma
Highlighted

Re: : skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block10

Communicator

Can you provide details of inputs.conf and server.conf of your indexers and heavy forwarders if you have any.
You might have a problem with your disk, perhaps the IOPS of your disk is not enough to handle your current splunk workload.

Cheers,
Dan

0 Karma