Splunk Enterprise

TailReader - Could not send data to output queue (parsingQueue), retrying..

Knightrider1234
Explorer

Hi guys,

I am seeing this error on one of my HWF, any clues to fix the issue?

  •  
  • 09-05-2021 14:11:21.437 +1000 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - Starting batchreader0 thread
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - tailreader0 waiting to be un-paused
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - Starting tailreader0 thread
  • 09-05-2021 14:10:40.826 +1000 INFO TailReader - Registering metrics callback for: batchreader0
Labels (1)
0 Karma
1 Solution

Vardhan
Contributor

Hi @Knightrider1234 ,

Try the below changes to resolve the issue.

1) change the thruput value in limits.conf  (/opt/splunk/etc/system/local/limits.conf)

[thruput]

maxKBps = 0

2) Increase the pipeline and do the changes in /opt/splunk/etc/system/local/server.conf

[general]

parallelIngestionPipelines = 2

3)Increase the parsing queue size in /opt/splunk/etc/system/local/server.conf

[queue=parsingQueue] 

maxSize = 64MB

After making the changes restart the Splunk server.

 

View solution in original post

0 Karma

Vardhan
Contributor

Hi @Knightrider1234 ,

Try the below changes to resolve the issue.

1) change the thruput value in limits.conf  (/opt/splunk/etc/system/local/limits.conf)

[thruput]

maxKBps = 0

2) Increase the pipeline and do the changes in /opt/splunk/etc/system/local/server.conf

[general]

parallelIngestionPipelines = 2

3)Increase the parsing queue size in /opt/splunk/etc/system/local/server.conf

[queue=parsingQueue] 

maxSize = 64MB

After making the changes restart the Splunk server.

 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...