Splunk Search

Error : The monitor input cannot produce data because splunkd's processing queues are full. This will be caused by inadequate indexing or forwarding rate, or a sudden burst of incoming data.

srampally
Path Finder

I am getting an error from Heavy Forwarder. Below is the error :

The monitor input cannot produce data because splunkd's processing queues are full. This will be caused by inadequate indexing or forwarding rate, or a sudden burst of incoming data.

Tags (1)

chrisyounger
SplunkTrust
SplunkTrust

This means that your heavy forwarder is ingesting too much data that it can't keep. Since the queues are full it can't run the monitor.

Either increase the hardware you have (either by adding more heavy forwarders or by adding my cpu's etc to the current machine).
or,
Figure out why it is trying to process so much data and try reduce that. For example, maybe you are processing lots of data but sending it to the null queue.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...