Splunk Indexer Error

abhijitnath89ax · ‎11-05-2020

We received the below error in splunkd.log on our indexer server. We are using cluster env with 6 indexers. The indexers are coming up and down

11-05-2020 07:43:17.734 +0000 WARN TcpInputProc - Stopping all listening ports. Queues blocked for more than 300 seconds
11-05-2020 07:43:17.734 +0000 INFO TcpInputProc - Stopping IPv4 port 9995
11-05-2020 07:43:17.734 +0000 INFO TcpInputProc - Stopping IPv4 port 9997

richgalloway · ‎11-05-2020

Why are the queues blocked? Use the Monitoring Console to see which queue is blocked then address it. Usually, a slow storage system is the cause.

---
If this reply helps you, Karma would be appreciated.

Splunk Indexer Error

indexer clustering

indexing performance

splunkd

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Conversation

Splunk Indexer Error

indexer clustering

indexing performance

splunkd

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station