Splunk Indexer Error

abhijitnath89ax · ‎11-05-2020

We received the below error in splunkd.log on our indexer server. We are using cluster env with 6 indexers. The indexers are coming up and down

11-05-2020 07:43:17.734 +0000 WARN TcpInputProc - Stopping all listening ports. Queues blocked for more than 300 seconds
11-05-2020 07:43:17.734 +0000 INFO TcpInputProc - Stopping IPv4 port 9995
11-05-2020 07:43:17.734 +0000 INFO TcpInputProc - Stopping IPv4 port 9997

richgalloway · ‎11-05-2020

Why are the queues blocked? Use the Monitoring Console to see which queue is blocked then address it. Usually, a slow storage system is the cause.

---
If this reply helps you, Karma would be appreciated.

Splunk Indexer Error

indexer clustering

indexing performance

splunkd

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Developer Spotlight with Mika Borner

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series

Join the Conversation

Splunk Indexer Error

indexer clustering

indexing performance

splunkd

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Developer Spotlight with Mika Borner

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series