I have and issues with red status : The monitor input cannot produce data because splunkd's processing queues are full. This will be caused by inadequate indexing or forwarding rate, or a sudden burst of incoming data.
i check in Indexing Performance: Instance and almost field had 100%
and when i check CPU and memory used and license used it had alot space
so how can i find the issues and can i fix this problem
The logical thing to do would be to check your IO saturation.
how can i check that ?
iostat/iotop/vmstat, your hardware monitoring tools
Work with your infrastructure team.