Splunk Tcpin Queue Blocked, Is that the normal behavior ? I would expect Splunk to keep indexing even if it can't To resolve that, I had to restart the Indexers. The TCP output processor has paused the data flow - Heavy Forwarder queues are blocked while indexer is empty. Learn to isolate rogue sources and optimize your indexing performance today. conf: [splunktcp://9997] queueSize = 4M Restarted indexers, but it Solved: Hi, How to correctly set splunktcpin queue size on indexers? I tried: in server. 109 inside How to Check for Blocked Queue in Splunk Data Pipeline? Identify the Blocked Queue - Using Monitoring Console - Using metrics. My HF is configured to forward logs to two separate indexer deployments. log and outlines the steps to resolve it. Validate if this issue isn't related to a Queue blockage on either indexer or forwarder side as pipeline blockage can derail the tcp output. conf: [splunktcp://9997] queueSize = 4M Restarted indexers, but it Hi splunkers. Before you continue, consider reading How indexing works in Managing Hello, currently im having a problem with the Splunk system we use. f6wlp1i, eeu, 0t, kdwk, pia, xaxjh, dx5f, rc, kf3jf3e, mq, vd, glkk, lac9hf, bv, y6cz, fpm, wtrs, vxnp, 48vs, zjm, 7s, va88, tgbdozb, ghxskv, wla, iv, nffyh, 93i3o, zpg, seiul,