https://community.splunk.com/t5/Getting-Data-In/The-TCP-output-processor-has-paused-the-data-flow-Forwarding-to/m-p/756741#M120026 <P>Hello everyone,</P><P>We are using a Universal Forwarder (UF) as an intermediate forwarder to send logs from other UFs in our on-premises environment to Splunk Cloud.</P><P>Whenever Splunk performs maintenance on our Splunk Cloud instance, the intermediate forwarder and all downstream UFs are unable to connect to Splunk Cloud. As a result,<STRONG> the forwarding queues on the forwarders become full.&nbsp;</STRONG></P><P>After the maintenance is completed and the Splunk Cloud instance is back online,<STRONG> the queued logs do not resume forwarding automatically. The data remains stuck in the queue until we manually restart the forwarders.</STRONG></P><P><STRONG><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image (4).png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/41069i55FEA08CA430BB09/image-size/large?v=v2&amp;px=999" role="button" title="image (4).png" alt="image (4).png" /></span></STRONG></P><P>We have tried increasing the <STRONG>[queue] maxSize</STRONG> settings in <STRONG>server.conf</STRONG>&nbsp;on IF, but this did not resolve the issue.</P><P>Has anyone else experienced this behavior, or have suggestions on how to handle it properly?</P><P>Thank you very much.</P><P>&nbsp;</P> Tue, 23 Dec 2025 07:18:31 GMT ThuLe 2025-12-23T07:18:31Z https://community.splunk.com/t5/Getting-Data-In/The-TCP-output-processor-has-paused-the-data-flow-Forwarding-to/m-p/756741#M120026 <P>Hello everyone,</P><P>We are using a Universal Forwarder (UF) as an intermediate forwarder to send logs from other UFs in our on-premises environment to Splunk Cloud.</P><P>Whenever Splunk performs maintenance on our Splunk Cloud instance, the intermediate forwarder and all downstream UFs are unable to connect to Splunk Cloud. As a result,<STRONG> the forwarding queues on the forwarders become full.&nbsp;</STRONG></P><P>After the maintenance is completed and the Splunk Cloud instance is back online,<STRONG> the queued logs do not resume forwarding automatically. The data remains stuck in the queue until we manually restart the forwarders.</STRONG></P><P><STRONG><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image (4).png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/41069i55FEA08CA430BB09/image-size/large?v=v2&amp;px=999" role="button" title="image (4).png" alt="image (4).png" /></span></STRONG></P><P>We have tried increasing the <STRONG>[queue] maxSize</STRONG> settings in <STRONG>server.conf</STRONG>&nbsp;on IF, but this did not resolve the issue.</P><P>Has anyone else experienced this behavior, or have suggestions on how to handle it properly?</P><P>Thank you very much.</P><P>&nbsp;</P> Tue, 23 Dec 2025 07:18:31 GMT https://community.splunk.com/t5/Getting-Data-In/The-TCP-output-processor-has-paused-the-data-flow-Forwarding-to/m-p/756741#M120026 ThuLe 2025-12-23T07:18:31Z https://community.splunk.com/t5/Getting-Data-In/The-TCP-output-processor-has-paused-the-data-flow-Forwarding-to/m-p/756742#M120027 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/260285">@ThuLe</a>&nbsp;,</P><P>I never experienced this behaviour also because I usually us two Hfs as concentrators to Splunk Cloud.</P><P>Anyway, at first did you configured&nbsp;</P><LI-CODE lang="markup">maxKBps = 0</LI-CODE><P>on your concentrator to avoid queues?</P><P>If yes, open a case to Splunk Support.</P><P>Ciao.</P><P>Giuseppe</P> Tue, 23 Dec 2025 07:37:41 GMT https://community.splunk.com/t5/Getting-Data-In/The-TCP-output-processor-has-paused-the-data-flow-Forwarding-to/m-p/756742#M120027 gcusello 2025-12-23T07:37:41Z