https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495169#M2906 <P>Hi, this was be solved on my environment by applying the below config on outputs.conf on your HeavyForwarder.</P> <P>[tcpout]<BR /> negotiateProtocolLevel = 0</P> <P>Once applied, you need to restart splunk service.</P> Tue, 11 Feb 2020 01:24:54 GMT jhomerlopez 2020-02-11T01:24:54Z https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495168#M2905 <P>Hi,</P> <P>I am dealing with an issue where after upgrading our Splunk environment from 7.2.3 to 8.0.1 we are having endless errrors as stated in the title on the indexers within the cluster.<BR /> <STRONG>Error - 01-23-2020 15:58:09.056 +0200 ERROR TcpInputProc - Encountered Streaming S2S error=Received reference to unknown channel_code=132 for data received from src=1</STRONG></P> <P>Data flow is - UF --&gt; Heavy Forwarder --&gt; Indexer</P> <P>Anyone that can shed some light on this?</P> Thu, 23 Jan 2020 14:37:40 GMT https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495168#M2905 QuintonS 2020-01-23T14:37:40Z https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495169#M2906 <P>Hi, this was be solved on my environment by applying the below config on outputs.conf on your HeavyForwarder.</P> <P>[tcpout]<BR /> negotiateProtocolLevel = 0</P> <P>Once applied, you need to restart splunk service.</P> Tue, 11 Feb 2020 01:24:54 GMT https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495169#M2906 jhomerlopez 2020-02-11T01:24:54Z https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495170#M2907 <P>In the Heavy Forwarders, You have to go to $SPLUNK_HOME/etc/system/local/Outputs.conf and add the value "negotiateProtocolLevel = 0" under the stanza [tcpout] then restart Splunk service. </P> <P>After you add that value in the configuration file, Splunk will start to use the old protocol to connect with indexers and the connection should be established again.</P> <P>[tcpout]<BR /> negotiateProtocolLevel = 0</P> Tue, 11 Feb 2020 04:02:16 GMT https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495170#M2907 yaasirvatham_sp 2020-02-11T04:02:16Z https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495171#M2908 <P>Thank you for the response, this solved my issue. Just another question is this only for the Heavy Forwarder to indexer or would it also be applicable from UF to Heavy Forwarder?</P> Tue, 11 Feb 2020 06:21:21 GMT https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495171#M2908 QuintonS 2020-02-11T06:21:21Z https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495172#M2909 <P>Thank you for the response, this solved my issue. Just another question is this only for the Heavy Forwarder to indexer or would it also be applicable from UF to Heavy Forwarder?</P> Tue, 11 Feb 2020 06:27:42 GMT https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495172#M2909 QuintonS 2020-02-11T06:27:42Z https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495173#M2910 <P>I am asking since the Heavy Forwarders have also been upgraded to 8.0.1 but the UF's are still running 7.2.3 and are in the process of being upgraded.</P> Tue, 11 Feb 2020 06:33:49 GMT https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495173#M2910 QuintonS 2020-02-11T06:33:49Z https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495174#M2911 <P>My Heavy Forwarders and Indexers are at version 8.0.2 and I still get the error. Why should we set the negotiateProtocolLevel to 0, if both servers (HF &amp; Indexer) are already at the newest version?</P> Fri, 21 Feb 2020 14:53:39 GMT https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495174#M2911 andreasz 2020-02-21T14:53:39Z https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495175#M2912 <P>Support confirmed that this is a bug (SPL-182112) for S2S communication between 8.x nodes. In my case I had issues between SH and INX. The recommendation was to set negotiateProtocolLevel=5 to downgrade the protocol version to 7.3. This can be done in the [tcpout] stanza on the sending node (SH), or in the [splunktcp] stanza on the receiving end (INX).</P> Thu, 27 Feb 2020 09:40:24 GMT https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/495175#M2912 arcsight_guru 2020-02-27T09:40:24Z https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/677005#M18626 <P><SPAN class="">The correct workaround should have been</SPAN></P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">[tcpout] negotiateProtocolLevel = 5</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P><SPAN class="">&nbsp;</SPAN><SPAN class="">negotiateProtocolLevel = 0 is no longer valid (see&nbsp;</SPAN><SPAN class="">enableOldS2SProtocol in 9.1.x outputs.conf)</SPAN></P><P><SPAN class="">with 9.1.x and is likely to cause issues.</SPAN></P> Thu, 08 Feb 2024 20:25:11 GMT https://community.splunk.com/t5/Splunk-Enterprise/After-Upgrade-from-Splunk-7-2-3-to-Splunk-8-0-1-we-get-error/m-p/677005#M18626 hrawat 2024-02-08T20:25:11Z