TailReader - Could not send data to output queue (parsingQueue), retrying..

[Knightrider1234]

Hi guys,

I am seeing this error on one of my HWF, any clues to fix the issue?

•  
• 09-05-2021 14:11:21.437 +1000 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...

• 09-05-2021 14:10:40.826 +1000 INFO TailReader - Starting batchreader0 thread
• 09-05-2021 14:10:40.826 +1000 INFO TailReader - tailreader0 waiting to be un-paused
• 09-05-2021 14:10:40.826 +1000 INFO TailReader - Starting tailreader0 thread
• 09-05-2021 14:10:40.826 +1000 INFO TailReader - Registering metrics callback for: batchreader0

[Vardhan · Accepted solution]

Hi @Knightrider1234 ,

Try the below changes to resolve the issue.

1) change the thruput value in limits.conf  (/opt/splunk/etc/system/local/limits.conf)

[thruput]

maxKBps = 0

2) Increase the pipeline and do the changes in /opt/splunk/etc/system/local/server.conf

[general]

parallelIngestionPipelines = 2

3)Increase the parsing queue size in /opt/splunk/etc/system/local/server.conf

[queue=parsingQueue] 

maxSize = 64MB

After making the changes restart the Splunk server.