Sometimes this happens when your CPU or Memory Usage is too high on the forwarders, or even the indexers.
Check your CPU usage and load averages, etc. If they are too high, you may need to upgrade some systems.
Or maybe even you need to optimize some large searches, etc.
A common cause of this is monitoring a super large folder like this:
[monitor://path/.../*.log]
You're effectively telling splunk to index everything under /path thats a .log file but maybe there are billions of files in this directory that are .txt files, etc. Splunk has to keep a running list of what it's already processed, etc. and things get messy... especially on non-reference hardware such as 1 CPU virtual machines, etc.
