Hi,
Due to some issue the splunk server is not searching any data and getting bellow error. even I am not able to telnet port number 9997 however it is already been added in splunk server.
Error:- "skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied"
I would install the Splunk On Splunk app http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk to find out what queue is congested (/en-US/app/sos/indexing_performance
).
As well you could a look at increasing the indexer [queue] maxSize
in http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Serverconf