Getting Data In

How to resolve when data is not forwarding to Indexer?

RAYUDU_NARA
Explorer

Hi Team,

We are facing an issue in Critical Production server, we are not able to monitor the server.
Data not forwarding from to the indexer.

somesoni2
SplunkTrust
SplunkTrust

I believe it's this (limits.conf)

[inputproc]
file_tracking_db_threshold_mb = <integer>
* This setting controls the trigger point at which the file tracking db (also
  commonly known as the "fishbucket" or btree) rolls over.  A new database is
  created in its place.  Writes are targeted at new db.  Reads are first
  targeted at new db, and we fall back to old db for read failures.  Any reads
  served from old db successfully will be written back into new db.
* MIGRATION NOTE: if this setting doesn't exist, the initialization code in
  splunkd triggers an automatic migration step that reads in the current value
  for "maxDataSize" under the "_thefishbucket" stanza in indexes.conf and
  writes this value into etc/system/local/limits.conf.
0 Karma

somesoni2
SplunkTrust
SplunkTrust

What's the account under which Splunk is running? Do you see access denied type of errors as well ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...