https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-on-Splunk-6-universal-forwarder-quot/m-p/125088#M25802 <P>how to fix this error , "WARN TcpOutputProc - Forwarding to indexer group GSOC blocked for 9500 seconds". I cant receive security logs or any logs from my DC Servers, I am using SUF version 6 on a deployment Server </P> Fri, 21 Nov 2014 08:35:06 GMT tiny3001 2014-11-21T08:35:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-on-Splunk-6-universal-forwarder-quot/m-p/125088#M25802 <P>how to fix this error , "WARN TcpOutputProc - Forwarding to indexer group GSOC blocked for 9500 seconds". I cant receive security logs or any logs from my DC Servers, I am using SUF version 6 on a deployment Server </P> Fri, 21 Nov 2014 08:35:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-on-Splunk-6-universal-forwarder-quot/m-p/125088#M25802 tiny3001 2014-11-21T08:35:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-on-Splunk-6-universal-forwarder-quot/m-p/125089#M25803 <P>Hi tiny3001,</P> <P>start troubleshooting why the queues are blocked. See the wiki <A href="http://wiki.splunk.com/Community:TroubleshootingBlockedQueues">http://wiki.splunk.com/Community:TroubleshootingBlockedQueues</A> or use the S.o.S. App <A href="https://apps.splunk.com/app/748/">https://apps.splunk.com/app/748/</A> on the indexer. As well start to setup persistent queues on the UF <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Usepersistentqueues">http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Usepersistentqueues</A></P> <P>cheers, MuS</P> Fri, 21 Nov 2014 08:48:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-on-Splunk-6-universal-forwarder-quot/m-p/125089#M25803 MuS 2014-11-21T08:48:19Z