Why am I getting TcpOutputQ errors in forwarders splunkd.log?

krishnarajapant — Mon, 13 Jun 2022 20:23:32 GMT

Hi Team,

We are constantly getting below errors in forwarders splukd.log

ERROR TCPOutputQ - Unexpected event id=4

ERROR TCPOutputQ - Unexpected event id=7

However we have observed data is getting ingested to splunkindexers with out any issue. can any one please help us to understand what exactly this error is related to

With Regards,

Krishna.

Re: Why am I getting TcpOutputQ errors in forwarders splunkd.log?

krishnarajapant — Tue, 14 Jun 2022 09:20:55 GMT

hi Team,

Any updated?

below are the more logs.

(IP's in the below logs are intentionally masked)

06-11-2022 10:18:11.819 +0000 WARN TcpOutputProc - Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/health.log|host::XXXXXXXXXXX|splunkd|727, streamId=0, offset=0 on host=xxxxxxxx:9997
06-11-2022 10:18:11.819 +0000 WARN TcpOutputProc - Possible duplication of events with channel=source::/var/log/cron|host::xxxxxxxxxx|cron|637, streamId=0, offset=0 on host=XXXXXXXXXXXX:9997
06-11-2022 10:18:11.827 +0000 ERROR TcpOutputQ - Unexpected event id=2
06-11-2022 10:18:11.829 +0000 INFO TcpOutputProc - Connected to idx=xxxxxxxxxx:9997, pset=0, reuse=0. using ACK.
06-11-2022 10:18:11.829 +0000 ERROR TcpOutputQ - Unexpected event id=3
06-11-2022 10:18:11.829 +0000 ERROR TcpOutputQ - Unexpected event id=4

topic Re: Why am I getting TcpOutputQ errors in forwarders splunkd.log? in Getting Data In

Why am I getting TcpOutputQ errors in forwarders splunkd.log?

Re: Why am I getting TcpOutputQ errors in forwarders splunkd.log?