Splunk Search

Splunk Server in (windows 2008 r2) is not searching data

sachinkum
New Member

Hi,
Due to some issue the splunk server is not searching any data and getting bellow error. even I am not able to telnet port number 9997 however it is already been added in splunk server.

Error:- "skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied"

Tags (1)
0 Karma

MarioM
Motivator

I would install the Splunk On Splunk app http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk to find out what queue is congested (/en-US/app/sos/indexing_performance).

As well you could a look at increasing the indexer [queue] maxSize in http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Serverconf

0 Karma
Get Updates on the Splunk Community!

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...

Thank You for Celebrating CX Day with Splunk!

Yesterday the entire team at Splunk + Cisco joined the global celebration of CX Day - celebrating our ...