Monitoring Splunk

Splunk Indexer Error

abhijitnath89ax
Loves-to-Learn

We received the below error in splunkd.log on our indexer server. We are using cluster env with 6 indexers. The indexers are coming up and down

11-05-2020 07:43:17.734 +0000 WARN TcpInputProc - Stopping all listening ports. Queues blocked for more than 300 seconds
11-05-2020 07:43:17.734 +0000 INFO TcpInputProc - Stopping IPv4 port 9995
11-05-2020 07:43:17.734 +0000 INFO TcpInputProc - Stopping IPv4 port 9997
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Why are the queues blocked?  Use the Monitoring Console to see which queue is blocked then address it.  Usually, a slow storage system is the cause.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...