cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
ggfloresca
Explorer
Member since: ‎05-08-2020
‎04-09-2024
Community Statistics
Posts 3
Solutions 0
Karma Given 4
Karma Received 0
Member Since ‎05-08-2020
Activity Feed
View All

Re: Lost file monitor on windows directory

by in Getting Data In
‎02-23-2021 10:57 AM
‎02-23-2021 10:57 AM
Still figuring out to clear the blocking in the queue, here's what I found in the splunkd.log, so far, now trying to figure out how to get the blocking cleared safely, any advice or recommendation is highly appreciated: 01-20-2021 19:00:56.435 +0000 INFO Metrics - group=pipeline, ingest_pipe=1, name=parsing, processor=sendout, cpu_seconds=1011.880, executes=3061051, cumulative_hits=2768837847 ... View more

Re: Lost file monitor on windows directory

by in Getting Data In
‎02-18-2021 06:10 PM
‎02-18-2021 06:10 PM
Thank you both for replying. scelikok, I think portion of your reply got truncated, anyways after investigating further I found a big burst of data, i meant "HUGE" on one of our server, now I'm trying to figure out, how and where to get the queue clear up, please advise --- UF --> IF --> idx. ... View more

Lost file monitor on windows directory

by in Getting Data In
‎02-16-2021 04:30 PM
‎02-16-2021 04:30 PM
We lost file monitor on multiple path on 2 specific windows servers, we're monitoring a very chatting high volume logs, it was working for a little bit, now it stopped ingesting the logs and we are getting the following error, warning and info in the log_level, need some help to troubleshoot on this, and isolating the bottleneck..... Thank   splunkd log: 01-17-2021 12:54:31.379 -0800 ERROR TailReader - Was unable to open file: D:\####\####\####\#####.log. 01-17-2021 18:10:07.686 -0800 WARN TailReader - Insufficient permissions to read file='D:\####\####\####\####.log' (hint: The system cannot find the file specified.) 01-18-2021 04:38:42.109 -0800 WARN TailReader - Could not send data to output queue (parsingQueue), retrying... 01-18-2021 04:38:42.109 -0800 WARN TailReader - Could not send data to output queue (parsingQueue), retrying... 01-19-2021 23:29:55.771 -0800 INFO PeriodicHealthReporter - feature="TailReader-0" color=red indicator="data_out_rate" due_to_threshold_value=2 measured_value=2 reason="The monitor input cannot produce data because splunkd's processing queues are full. This will be caused by inadequate indexing or forwarding rate, or a sudden burst of incoming data." node_type=indicator node_path=splunkd.file_monitor_input.tailreader-0.data_out_rate ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎04-09-2024 04:04 PM
Karma given to
View All