Splunk Enterprise

TailReader - Could not send data to output queue (parsingQueue), retrying..

Knightrider1234
Engager

Hi guys,

I am seeing this error on one of my HWF, any clues to fix the issue?

  •  
  • 09-05-2021 14:11:21.437 +1000 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - Starting batchreader0 thread
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - tailreader0 waiting to be un-paused
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - Starting tailreader0 thread
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - Registering metrics callback for: batchreader0
Labels (1)
0 Karma
1 Solution

Vardhan
Contributor

Hi @Knightrider1234 ,

Try the below changes to resolve the issue.

1) change the thruput value in limits.conf  (/opt/splunk/etc/system/local/limits.conf)

[thruput]

maxKBps = 0

2) Increase the pipeline and do the changes in /opt/splunk/etc/system/local/server.conf

[general]

parallelIngestionPipelines = 2

3)Increase the parsing queue size in /opt/splunk/etc/system/local/server.conf

[queue=parsingQueue] 

maxSize = 64MB

After making the changes restart the Splunk server.

 

View solution in original post

0 Karma

Vardhan
Contributor

Hi @Knightrider1234 ,

Try the below changes to resolve the issue.

1) change the thruput value in limits.conf  (/opt/splunk/etc/system/local/limits.conf)

[thruput]

maxKBps = 0

2) Increase the pipeline and do the changes in /opt/splunk/etc/system/local/server.conf

[general]

parallelIngestionPipelines = 2

3)Increase the parsing queue size in /opt/splunk/etc/system/local/server.conf

[queue=parsingQueue] 

maxSize = 64MB

After making the changes restart the Splunk server.

 

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...