DB Connect - Db inputs it's not collecting all the data, input status failed

Available Languages

Updated:September 29, 2026

Document ID:SPLK046206

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Apps Add ons

Description

DB Inputs collects the data, however after a few request it fails and then only ingest 50% of the rows.Review metrics.log, and SSL issues.

Investigation

Root cause of the issue:

Blocked queues in metrics.log:

INFO Metrics - group=queue, name=aggqueue, blocked=true, max_size_kb=1024, current_size_kb=1023,
current_size=2015, largest_size=2424, smallest_size=0INFO Metrics - group=queue, name=httpinputq, blocked=true, max_size_kb=500, current_size_kb=499,
current_size=1046, largest_size=1130, smallest_size=0INFO Metrics - group=queue, name=indexqueue, blocked=true, max_size_kb=500, current_size_kb=499,
current_size=982, largest_size=1242, smallest_size=0INFO Metrics - group=queue, name=typingqueue, blocked=true, max_size_kb=500, current_size_kb=499,
current_size=986, largest_size=1240, smallest_size=0

The first log to pay attention is this one:

TailReader - Could not send data to output queue (parsingQueue)

This could indicate that your HF is receiving/collecting data faster than it can send it to your indexers.

The next warning is therefore also important

TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output 
group cloud_heavyforwarders has been blocked for 10 seconds.

That means that your indexers (or the network to them) is throttling your data flow, this could be an issue on the indexers, however if you are seeing no problems on that side, then congestion or load is the likely culprit.

Resolution

THP is enabled, this feature is known to cause performance issues with some apps including Splunk, so it's recommended that you disable it or set it to madvise. More info in the link below:

Splunk and THP

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)