Splunk Enterprise

TailReader - Could not send data to output queue (parsingQueue), retrying..

Knightrider1234
Engager

Hi guys,

I am seeing this error on one of my HWF, any clues to fix the issue?

  •  
  • 09-05-2021 14:11:21.437 +1000 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - Starting batchreader0 thread
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - tailreader0 waiting to be un-paused
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - Starting tailreader0 thread
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - Registering metrics callback for: batchreader0
Labels (1)
0 Karma
1 Solution

Vardhan
Contributor

Hi @Knightrider1234 ,

Try the below changes to resolve the issue.

1) change the thruput value in limits.conf  (/opt/splunk/etc/system/local/limits.conf)

[thruput]

maxKBps = 0

2) Increase the pipeline and do the changes in /opt/splunk/etc/system/local/server.conf

[general]

parallelIngestionPipelines = 2

3)Increase the parsing queue size in /opt/splunk/etc/system/local/server.conf

[queue=parsingQueue] 

maxSize = 64MB

After making the changes restart the Splunk server.

 

View solution in original post

0 Karma

Vardhan
Contributor

Hi @Knightrider1234 ,

Try the below changes to resolve the issue.

1) change the thruput value in limits.conf  (/opt/splunk/etc/system/local/limits.conf)

[thruput]

maxKBps = 0

2) Increase the pipeline and do the changes in /opt/splunk/etc/system/local/server.conf

[general]

parallelIngestionPipelines = 2

3)Increase the parsing queue size in /opt/splunk/etc/system/local/server.conf

[queue=parsingQueue] 

maxSize = 64MB

After making the changes restart the Splunk server.

 

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.