topic How to resolve error Forwarding to indexer group default-autolb-group blocked for 2400 seconds."? in Getting Data In

How to resolve error Forwarding to indexer group default-autolb-group blocked for 2400 seconds."?

vad34 — Tue, 29 Dec 2015 15:55:32 GMT

Hello!

I am getting the following error:

Forwarding to indexer group default-autolb-group blocked for 2400 seconds.

I have configured inputs.conf to filter Windows events (System, Security etc..)
I have configured a heavy forwarder (with another SPLUNK instance)

My outputs.conf is:

[tcpout]
defaultGroup = default-autolb-group
indexAndForward = 0

[tcpout:default-autolb-group]
server = X.X.X.X:9997

[tcpout-server://X.X.X.X:9997]

Any ideas how to solve it?
Tnx in advance

Re: How to resolve error Forwarding to indexer group default-autolb-group blocked for 2400 seconds."?

jkat54 — Tue, 29 Dec 2015 17:49:30 GMT

Have you verified that port 9997 is open between the devices using something like telnet?

telnet x.y.z.a 9997

Should give you a blank screen with blinking cursor. You'll have to press ctrl + ] to break out of the telnet session. If you dont get the blank screen with blinking cursor, the port isnt open or the indexer isnt listening

On the indexer you can run netstat -an | grep 9997 to see if it's listening on the port.