"ERROR TcpInputProc - Message rejected" error in heavy forwarder's splunkd.log when trying to receive events from Indexer.

pavanae — Tue, 25 Feb 2020 21:46:30 GMT

Hello,

Configured an Indexer to send the data to a Heavy forwarder.

I am able to telnet to the heavyforwarder with port XXXX from indexer without any issue.

The following is my outputs.conf in Indexer :-

[tcpout]
defaultGroup = dev_null
indexAndForward = true
forwardedindex.filter.disable = true

[tcpout:server_output]
dropEventsOnQueueFull = 10
maxQueueSize = 50MB
server = xyz.com:zzzz
sendCookedData = false
clientCert = XXXXX
useACK = false
sslPassword = YYYYY

As specified above xyz.com is my heavy forwarder where I am trying to forward the data from indexer

The following is my inputs.conf in heavy forwarder(xyz.com)

[splunktcp]
route=has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:typingQueue;absent_key:_linebreaker:parsingQueue

[splunktcp-ssl:XXXX]
queueSize = 100MB

[SSL]
serverCert = XXXXXXX
requireClientCert = true
sslPassword = XXXXX

Now I am seeing the following ERROR in Heavy forwarder's splunkd.log

 ERROR TcpInputProc - Message rejected. Received unexpected message of size=842019376 bytes from src=X.X.X.X:YYYY in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

Any idea on how this can be resolved and have a data transfer from indexer to heavy forwarder?

Also, The data that I'm trying to transfer from indexer is not that huge. Doesn't make any sense on the high vollume error message.

Re: "ERROR TcpInputProc - Message rejected" error in heavy forwarder's splunkd.log when trying to receive events from Indexer.

manjunathmeti — Wed, 26 Feb 2020 11:04:39 GMT

Input splunktcp-ssl expects parsed data from sender but you have set sendCookedData to false in outputs.conf on indexer server. You need to set this attribute to true.

topic Re: "ERROR TcpInputProc - Message rejected" error in heavy forwarder's splunkd.log when trying to receive events from Indexer. in Getting Data In

"ERROR TcpInputProc - Message rejected" error in heavy forwarder's splunkd.log when trying to receive events from Indexer.

Re: "ERROR TcpInputProc - Message rejected" error in heavy forwarder's splunkd.log when trying to receive events from Indexer.