https://community.splunk.com/t5/Getting-Data-In/Linux-Blocking-Event-Forwarding/m-p/371595#M67451 <P>The log complaining about not reaching the indexer group is from the forwarder?</P> <P>Can you connect to the one of the indexers from the forwarder manually? You can use openssl to try it, if it can connect just use ctrl+c to break out of it. Don't worry if it mentions ssl handshake failures, this is just to make sure the indexer port is accessible from the forwarder.</P> <PRE><CODE>openssl s_client -connect {indexer_ip}:9997 </CODE></PRE> Wed, 10 May 2017 20:50:26 GMT wenthold 2017-05-10T20:50:26Z https://community.splunk.com/t5/Getting-Data-In/Linux-Blocking-Event-Forwarding/m-p/371594#M67450 <P>It's always something! </P> <P>Now my Linux forwarder is saying the following: </P> <P>05-10-2017 09:11:02.584 -0400 WARN TcpOutputProc - Forwarding to indexer group splunk1 blocked for 87500 seconds.<BR /> 05-10-2017 09:12:42.594 -0400 WARN TcpOutputProc - Forwarding to indexer group splunk1 blocked for 87600 seconds.<BR /> 05-10-2017 09:14:22.605 -0400 WARN TcpOutputProc - Forwarding to indexer group splunk1 blocked for 87700 seconds.</P> <P>I checked to ensure that there was no outputs.conf file on the indexer (we only have 1) which would cause a loop. </P> <P>I am so lost. Any other ideas?</P> Wed, 10 May 2017 13:30:20 GMT https://community.splunk.com/t5/Getting-Data-In/Linux-Blocking-Event-Forwarding/m-p/371594#M67450 heats 2017-05-10T13:30:20Z https://community.splunk.com/t5/Getting-Data-In/Linux-Blocking-Event-Forwarding/m-p/371595#M67451 <P>The log complaining about not reaching the indexer group is from the forwarder?</P> <P>Can you connect to the one of the indexers from the forwarder manually? You can use openssl to try it, if it can connect just use ctrl+c to break out of it. Don't worry if it mentions ssl handshake failures, this is just to make sure the indexer port is accessible from the forwarder.</P> <PRE><CODE>openssl s_client -connect {indexer_ip}:9997 </CODE></PRE> Wed, 10 May 2017 20:50:26 GMT https://community.splunk.com/t5/Getting-Data-In/Linux-Blocking-Event-Forwarding/m-p/371595#M67451 wenthold 2017-05-10T20:50:26Z