https://community.splunk.com/t5/Getting-Data-In/unable-to-search-index-quot-internal-quot-for-heavy-forwarder/m-p/347919#M63885 <P>Hi All, Suddenly I am unable to search the index="_internal" for all heavy forwarder instance from search head console. When checked in the splunk HF instances, could see /opt/splunk/etc/var/log/splunk/splunkd.log are getting updated but the same is not able to searched via splunk console. </P> <P>I could see this message getting popped out in HF console .</P> <P>"Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group all_indexers has been blocked for 10 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data"</P> <P>Kindly guide me how to troubleshoot this issue.</P> Wed, 01 Nov 2017 14:08:57 GMT Hemnaath 2017-11-01T14:08:57Z https://community.splunk.com/t5/Getting-Data-In/unable-to-search-index-quot-internal-quot-for-heavy-forwarder/m-p/347919#M63885 <P>Hi All, Suddenly I am unable to search the index="_internal" for all heavy forwarder instance from search head console. When checked in the splunk HF instances, could see /opt/splunk/etc/var/log/splunk/splunkd.log are getting updated but the same is not able to searched via splunk console. </P> <P>I could see this message getting popped out in HF console .</P> <P>"Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group all_indexers has been blocked for 10 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data"</P> <P>Kindly guide me how to troubleshoot this issue.</P> Wed, 01 Nov 2017 14:08:57 GMT https://community.splunk.com/t5/Getting-Data-In/unable-to-search-index-quot-internal-quot-for-heavy-forwarder/m-p/347919#M63885 Hemnaath 2017-11-01T14:08:57Z https://community.splunk.com/t5/Getting-Data-In/unable-to-search-index-quot-internal-quot-for-heavy-forwarder/m-p/347920#M63886 <P>Hi All, Can any one guide me on this issue. <BR /> thanks in advance. </P> Wed, 01 Nov 2017 14:58:57 GMT https://community.splunk.com/t5/Getting-Data-In/unable-to-search-index-quot-internal-quot-for-heavy-forwarder/m-p/347920#M63886 Hemnaath 2017-11-01T14:58:57Z https://community.splunk.com/t5/Getting-Data-In/unable-to-search-index-quot-internal-quot-for-heavy-forwarder/m-p/347921#M63887 <P>Few posts with similar issues.</P> <P><A href="https://answers.splunk.com/answers/395859/how-to-fix-error-forwarding-to-indexer-group-defau.html">https://answers.splunk.com/answers/395859/how-to-fix-error-forwarding-to-indexer-group-defau.html</A><BR /> <A href="https://answers.splunk.com/answers/337288/how-to-resolve-error-forwarding-to-indexer-group-d.html">https://answers.splunk.com/answers/337288/how-to-resolve-error-forwarding-to-indexer-group-d.html</A></P> Wed, 01 Nov 2017 15:16:13 GMT https://community.splunk.com/t5/Getting-Data-In/unable-to-search-index-quot-internal-quot-for-heavy-forwarder/m-p/347921#M63887 somesoni2 2017-11-01T15:16:13Z https://community.splunk.com/t5/Getting-Data-In/unable-to-search-index-quot-internal-quot-for-heavy-forwarder/m-p/347922#M63888 <P>Hi somesoni2, thanks for your effort, I hope the issue got fixed, we are able to search the index="_internal" for all heavy forwarder instance from search head console. </P> <P>After restarting the splunk service the issue is fixed. </P> <P>thanks for your effort. </P> Wed, 01 Nov 2017 16:03:20 GMT https://community.splunk.com/t5/Getting-Data-In/unable-to-search-index-quot-internal-quot-for-heavy-forwarder/m-p/347922#M63888 Hemnaath 2017-11-01T16:03:20Z