https://community.splunk.com/t5/Getting-Data-In/Failed-to-resurrect-x-byte-message/m-p/90929#M18883 <P>Forwarder is sending compressed data and the indexer is expecting uncompressed? or vice-versa? make sure outputs.conf on the forwarder and inputs.conf on the indexer are configured properly.</P> Mon, 14 May 2012 19:25:22 GMT wbfoxii 2012-05-14T19:25:22Z https://community.splunk.com/t5/Getting-Data-In/Failed-to-resurrect-x-byte-message/m-p/90928#M18882 <P>I am seeing a continuous stream of error messages on one of my indexers, such as this sample:</P> <PRE><CODE>03-13-2012 15:28:33.861 +0000 WARN PipelineInputChannel - channel "source::C:\Program Files\SplunkUniversalForwarder/var/log/splunk/splunkd.log|host::DC-SERVER-21|SplunkUniversalForwarder/var/log/splunk/splunkd-2|remoteport::2239" ended without a done-key 03-13-2012 15:28:34.034 +0000 ERROR TcpInputProc - Failed to resurrect 954 byte message! from src=10.9.81.21:2238 03-13-2012 15:28:34.934 +0000 ERROR TcpInputProc - Failed to resurrect 1338 byte message! from src=10.9.81.21:2250 03-13-2012 15:28:36.890 +0000 ERROR TcpInputProc - Failed to resurrect 1290 byte message! from src=10.9.81.21:2258 03-13-2012 15:28:37.442 +0000 ERROR TcpInputProc - Failed to resurrect 1262 byte message! from src=10.9.81.21:2247 03-13-2012 15:28:37.810 +0000 ERROR TcpInputProc - Failed to resurrect 1290 byte message! from src=10.9.81.21:2259 03-13-2012 15:28:39.911 +0000 ERROR TcpInputProc - Failed to resurrect 1290 byte message! from src=10.9.81.21:2267 </CODE></PRE> <P>Any ideas on how to identify the problem? The forwarder is running on Windows. Thanks!</P> Tue, 13 Mar 2012 15:34:16 GMT https://community.splunk.com/t5/Getting-Data-In/Failed-to-resurrect-x-byte-message/m-p/90928#M18882 eugenekogan 2012-03-13T15:34:16Z https://community.splunk.com/t5/Getting-Data-In/Failed-to-resurrect-x-byte-message/m-p/90929#M18883 <P>Forwarder is sending compressed data and the indexer is expecting uncompressed? or vice-versa? make sure outputs.conf on the forwarder and inputs.conf on the indexer are configured properly.</P> Mon, 14 May 2012 19:25:22 GMT https://community.splunk.com/t5/Getting-Data-In/Failed-to-resurrect-x-byte-message/m-p/90929#M18883 wbfoxii 2012-05-14T19:25:22Z