How to fix this error in health?

[Sandev]

 Ingestion Latency

• Root Cause(s):
  • Events from tracker.log have not been seen for the last 74130 seconds, which is more than the red threshold (210 seconds). This typically occurs when indexing or forwarding are falling behind or are blocked.

[thangbui]

This is the problem I have. Has someone found a solution to this problem

[jdcabanglan]

Did someone knows how to fix it?

[richgalloway]

Others have reported that problem as well (but not me).  See if this Answer helps.

https://community.splunk.com/t5/Splunk-Enterprise/Ingestion-Latency-after-updating-to-8-2-1/m-p/5585...

[phil__tanner]

I'm also getting this after upgrading from 8.1.3 to 8.2.5 last night.

I have tried the mitigations in that linked post, unfortunately to no avail.

It's not stopped indexing, occasionally it'll catch up and the message disappears, but then over time it will build back up again, before the cycle repeats.

Any other ideas?

[bvv]

same here after upgrade from 7.2 > 8.1.3 > 8.2.5.

8.2.6 came out today hopefully it could be a fix but tried without luck.

in my situation searches aren't running at all.

Ingestion Latency and Search Scheduler Searches Skipped appear in red.

[phil__tanner]

That sounds identical to our upgrade route. Originally (7.2) on Ubuntu 18.04 (from an Azure pre-packaged Splunk image), then 8.1.3 & Ubuntu 20.04.