topic Re: just started learning splunk in Getting Data In

just started learning splunk

deepmis — Sat, 19 Dec 2020 16:12:44 GMT

How do I resolve this error -> happens with both linux and mac

The TCP output processor has paused the data flow. Forwarding to host_dest=192.168.1.5 inside output group default-autolb-group from host_src=MacBook-Air.local has been blocked for blocked_seconds=10. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data

Re: just started learning splunk

saravanan90 — Sat, 19 Dec 2020 16:18:57 GMT

Check the firewall communication.

Re: just started learning splunk

deepmis — Sat, 19 Dec 2020 16:39:07 GMT

There is no firewall .. its a home computer

Re: just started learning splunk

saravanan90 — Sat, 19 Dec 2020 16:52:47 GMT

Mostly this could be firewall issue. Check the host firewall by connecting to destination server.
From forwarder we can telnet to destination to confirm the same

telnet indexer 9997

Re: just started learning splunk

gcusello — Sat, 19 Dec 2020 16:55:35 GMT

Hi @deepmis,

the message you have means that the client cannot reach to send logs to the indexer because it's closed the connection.

At first a stupid question. di you enabled receiving on Indexer? on port 9997?

If yes, try using telnet to see if the connection is open from the client to the indexer:

telnet ip_indexer 9997

then verify that the IP addresses of your computers are in the same network.

Ciao.

Giuseppe