An engineer observes a delay in data being indexed from a remote location.

If there is a delay in data being indexed from a remote location, even though the Universal Forwarder (UF) is correctly configured, the issue is likely a queue blockage or network latency.

Steps to Diagnose and Fix Forwarder Delays:

Check Forwarder Logs (splunkd.log) for Queue Issues (A)

Look for messages likeTcpOutAutoLoadBalancedorQueue is full.

If queues are full, events are stuck at the forwarder and not reaching the indexer.

Monitor Forwarder Health Usingmetrics.log

Useindex=_internal source=*metrics.log* group=queueto check queue performance.