Parsing Queue blocked on Heavy Forwarder

Applicability

Splunk Cloud Splunk Enterprise

Description

Parsing Queue blocked on Heavy Forwarder or there are delays in data being sent.
 

index=_internal host=HF blocked=true

The default thruput setting on a HF is 256kbs. It is better to change/add the value in limits.conf to maxKBps=0, or a number greater than the default.

This can be done incrementally if there are concerns about network overhead.

The forwarder is being throttled and cannot keep up with the data it's trying to send to the indexers.

[thruput]
maxKBps = 0  (unlimited)

Investigation

To confirm the problem look for the following error in $SPLUNK_HOME/var/log/splunk/splunkd.log:

INFO ThruputProcessor [1162526 indexerPipe] - Current data throughput (256 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.

You can also run for the error using the following search via the UI, if you have access. 

index=_internal sourcetype=splunkd ThruputProcessor 

 

Resolution

Increasing the maxKBPs should help in most cases. 

Check limits.conf for more information. 

Related Links

Splunk Community
Parsing Queue blocked on Heavy Forwarder

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release