hi
i have installed a universal forwarder but getting this error and not seeing any monitoring files data in splunk
5:24:21 PM Karthick Venkata: 06-05-2012 04:39:10.891 -0700 INFO WatchedFile - Will begin reading at offset=2555904 for file='c:\inetpub\logs\logfiles\W3SVC1\u_ex101201.log'.
06-05-2012 04:39:56.831 -0700 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
06-05-2012 04:40:01.839 -0700 INFO TailingProcessor - ...continuing.
06-05-2012 04:40:15.895 -0700 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
06-05-2012 04:40:20.903 -0700 INFO Tail
Does anything here help you? Similar issue so might help you find what's causing your parsingQueue to be filled up.
http://splunk-base.splunk.com/answers/5590/could-not-send-data-to-the-output-queue
Does anything here help you? Similar issue so might help you find what's causing your parsingQueue to be filled up.
http://splunk-base.splunk.com/answers/5590/could-not-send-data-to-the-output-queue
this error is in splunkd.log file