https://community.splunk.com/t5/Getting-Data-In/Cant-get-windows-server-into-splunk/m-p/531224#M89375 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/229217">@davidbeiler</a>,</P><P>only one question: after the pause, you continued to have logs from this server or they stopped?</P><P>if they continued to arrive (eventually late) probably there was a temporary network congestion caused by the network and/or the data flow (I don't think because this seems a lab configuration) or more probably by the index queue caused by the storage performances.</P><P>If instead they don't arrive more, there's something in the middle that blocks the data flow:</P><UL><LI>are there other forwarders that are sending logs?</LI><LI>did you tested with telnet the connection on port 9997?</LI></UL><P>Ciao.</P><P>Giuseppe</P> Sat, 28 Nov 2020 07:26:51 GMT gcusello 2020-11-28T07:26:51Z https://community.splunk.com/t5/Getting-Data-In/Cant-get-windows-server-into-splunk/m-p/531220#M89373 <P>Im pretty technical... i got splunk installed in centos, everything works ok, but for the life of me i cant figure this out</P><P>11-27-2020 23:53:54.093 -0500 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to host_dest=192.168.1.109 inside output group default-autolb-group from host_src=splunk has been blocked for blocked_seconds=710. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.</P><P>Ports are open for 8000, 9997 (receiving port), and opened 8089.&nbsp; Plenty of disk space, though when i do ss -l | grep 9997 i do not see anything for port 9997, even though ive unblocked the port 1000 times</P> Sat, 28 Nov 2020 05:10:41 GMT https://community.splunk.com/t5/Getting-Data-In/Cant-get-windows-server-into-splunk/m-p/531220#M89373 davidbeiler 2020-11-28T05:10:41Z https://community.splunk.com/t5/Getting-Data-In/Cant-get-windows-server-into-splunk/m-p/531224#M89375 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/229217">@davidbeiler</a>,</P><P>only one question: after the pause, you continued to have logs from this server or they stopped?</P><P>if they continued to arrive (eventually late) probably there was a temporary network congestion caused by the network and/or the data flow (I don't think because this seems a lab configuration) or more probably by the index queue caused by the storage performances.</P><P>If instead they don't arrive more, there's something in the middle that blocks the data flow:</P><UL><LI>are there other forwarders that are sending logs?</LI><LI>did you tested with telnet the connection on port 9997?</LI></UL><P>Ciao.</P><P>Giuseppe</P> Sat, 28 Nov 2020 07:26:51 GMT https://community.splunk.com/t5/Getting-Data-In/Cant-get-windows-server-into-splunk/m-p/531224#M89375 gcusello 2020-11-28T07:26:51Z