hi,
we have activated parallelIngestionPipelines (set to 2) due to blocked queues on a heavy forwarder. After adding another pipeline, there is no change in the congestion and it seems that only one pipeline is used by Splunk.
Pipeline 0 still gets blocked and filled to 100% and pipeline 1 processes only on rare occasions, usually filled to 0 %. Any idea what could cause this unexptected behavior?
↧