Description
Hi team,
I recently experienced this issue and post this Splunk isn't able to poll any messages. Is there any threshold set in the configuration or what is the default threshold?
I am trying to understand on when this problem arises?
My initial analysis is as follows:
When I try to send 100 messages to Splunk and due to its efficiency it could only take 80 and remaining 20 were paused at that moment and after sometime these remaining messages are also polled. However, these 20 will be added to offset no matter if they are polled later. I am wandering this offset got cumulated/increased in the same way and reached the threshold limit which resulted in this error.
Based on my research, many have suggested to add the offset.flush.interval.ms in properties which I have already added and gave as 10s.
Despite this property being added, I still faced this issue. Is there anything that I understood wrong or is my analysis no where related to this problem.
Apologies if its irrelevant.
It would be helpful if you suggest how to resolve this :)
Thanks in Advance.