Monitoring Splunk

TailReader error 8.0.2 splunkd's processing queues are full

Donwadyka
Observer

Getting the following error on my Splunk Enterprise Server and I'm not able to get usage.log info.  Can anyone point me in the right direction?

 

Root Cause(s):
The monitor input cannot produce data because splunkd's processing queues are full. This will be caused by inadequate indexing or forwarding rate, or a sudden burst of incoming data.
Last 50 related messages:
08-05-2020 16:05:22.039 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
08-05-2020 16:05:17.033 -0500 INFO TailReader - ...continuing.
08-05-2020 16:05:12.033 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
08-05-2020 16:05:06.899 -0500 INFO TailReader - File descriptor cache is full (1000), trimming...

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Check settings - monitoring console - indexing - performance- instance / deployment depending your setup. 
r. Ismo

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...