Enqueuing a very large in the batch reader, reading of other large files could be delayed

[samadmemon]

Hi All,

We are facing issues where syslog server is storing Palo Alto logs in a directory and from Universal forwarder on the syslog server we are reading the logs.

Universal forwarder is not reading the logs and sending it to the indexer . Below is the warning shown in splunkd.log

Enqueuing a very large in the batch reader, reading of other large files could be delayed

Could anyone please help how to fix this issue.

Regards,
Samad

[jkoshti_splunk · Accepted solution]

Are you also noticing the following messages in your splunkd.log along with the enqueuing very large file message?

INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...

Also, what is your maxKBps settings in limits.conf on the Forwarder where you see this message? By default it is
$SPLUNK_HOME/etc/system/default/limits.conf
[thruput]
maxKBps=256

you can try increasing to 512 (double than default) or 0 (unlimited) in $SPLUNK_HOME/etc/system/local/limits.conf
[thruput]
maxKBps=512

Check out this article:
https://docs.splunk.com/Documentation/Splunk/7.2.0/Troubleshooting/Troubleshootingeventsindexingdela...

[deva1995]

Hi, i added some stanza, and the newly added monitor files did not get indexed.
However, old files are still sending the data.