topic Re: Index servers TcpInputProc error messages in Splunk Enterprise

Index servers TcpInputProc error messages

fuster_j — Tue, 19 Jun 2012 18:50:10 GMT

I have 2 index servers that is LB and listening to port 9997. Both are getting a lot of this message in splunkd.log:

06-19-2012 10:23:59.920 ERROR TcpInputProc - Error encountered for connection from src=:. Timeout

Is it because the port 9997 is saturated? Do I need more index server to fix the issue? How do I debug it? Or, how can I determine if NIC TCP 9997 is saturated without installing 3rd party tool?

Re: Index servers TcpInputProc error messages

ppriyanjith — Mon, 28 Sep 2020 13:00:39 GMT

I am also having the same setup(two indexes) and my listening port is 51099 and facing same issue. futher I can see below error message as well in forwader log

12-22-2012 22:54:53.703 +0000 INFO TcpOutputProc - tcpout group splunk_recieving_nodes using Auto load balanced forwarding
12-22-2012 22:54:53.703 +0000 INFO TcpOutputProc - Group splunk_recieving_nodes initialized with maxQueueSize=512000 in bytes.
12-22-2012 22:54:53.703 +0000 ERROR TcpOutputProc - the 'defaultGroup' property contains an invalid group name - splunk_recieving_nodes - skipping
12-22-2012 22:54:53.703 +0000 WARN TcpOutputProc - Default groupList has not yet been calculated!

can anyone help to resolve this issue

Re: Index servers TcpInputProc error messages

athorat3 — Wed, 08 Apr 2015 22:59:50 GMT

Getting a similiar error : default group property contains invalid group name

Any Luck with you guys?