topic Can see lot of ERROR messages in universal forwarders in Splunk Enterprise

Can see lot of ERROR messages in universal forwarders

kiranpanchavat1 — Thu, 28 Oct 2021 06:14:58 GMT

ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=xxxx:xxxx in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

Re: Can see lot of ERROR messages in universal forwarders

isoutamo — Thu, 28 Oct 2021 06:25:29 GMT

Can you check that you are not sending e.g. some tcp feed to splunk-tcp port which are expecting S2S protocol. There should be separate ports for other than S2S traffic defined one per different protocols.

Re: Can see lot of ERROR messages in universal forwarders

kiranpanchavat1 — Thu, 28 Oct 2021 06:28:05 GMT

@isoutamo

We created separate inputs.conf for SSL

cat inputs.conf
[splunktcp-ssl:9997]
disabled=0

Re: Can see lot of ERROR messages in universal forwarders

isoutamo — Thu, 28 Oct 2021 06:35:12 GMT

Have you defined on both side (UF and Indexer) that port the same way and also use the same certs etc?

Have you a separate port for splunktcp or are you using only splunktcp-ssl? You cannot mix that traffic to one port.

r. Ismo

Re: Can see lot of ERROR messages in universal forwarders

kiranpanchavat1 — Thu, 28 Oct 2021 06:37:10 GMT

@isoutamo Will check those configs and let you know