Splunk Search

Splunk Server in (windows 2008 r2) is not searching data

sachinkum
New Member

Hi,
Due to some issue the splunk server is not searching any data and getting bellow error. even I am not able to telnet port number 9997 however it is already been added in splunk server.

Error:- "skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied"

Tags (1)
0 Karma

MarioM
Motivator

I would install the Splunk On Splunk app http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk to find out what queue is congested (/en-US/app/sos/indexing_performance).

As well you could a look at increasing the indexer [queue] maxSize in http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Serverconf

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...