Index is hanging often

[aelliott]

We recently setup DB Connect 1.1.1 and started pulling in data.
An issue we've ran into is the indexers are hanging and this did not start happening until installing DB Connect.
So I looked into it (via SoS) and saw that the index ratio is at 8.9 (for the index that DB connect input is feeding) the hour that our indexes started hanging. This has to be the reason our indexes are hanging. Is there a way to lower that indexing ratio?

[aelliott · Accepted solution]

We found that our anti-virus was locking key files and index buckets which affected splunk's indexing mechanism. This issue is now gone.

[araitz]

Although Splunk Answers is really useful for answering simple questions and answers, it really isn't the best place to get down to root causes of issues. Opening a support case will better allow us to help solve the problem you are encountering in your environment.

[aelliott]

Hardly anything, I make the query so that it only pulls the last 5 minutes or so and it is usually less than 20,000 records.

I waited for it to recover and over a day it did not recover.

[lukejadamec]

How much data was pulled initially?

I have seen GB's worth of data from a new dbx input stall splunk, but it recovers on its own over time.