<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Error on forwarder in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537207#M90042</link>
    <description>&lt;P&gt;we can close topic, I resolved the problem&lt;/P&gt;&lt;P&gt;ty&lt;/P&gt;</description>
    <pubDate>Tue, 26 Jan 2021 13:05:24 GMT</pubDate>
    <dc:creator>bosseres</dc:creator>
    <dc:date>2021-01-26T13:05:24Z</dc:date>
    <item>
      <title>Error on forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537199#M90038</link>
      <description>&lt;P&gt;Hello everyone,&lt;/P&gt;&lt;P&gt;I'm trying to configure deployment server and i have a error, occured on forwarder&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;TCPOutAutoLB-1&lt;/SPAN&gt;&lt;/P&gt;&lt;UL&gt;&lt;LI&gt;&lt;STRONG&gt;Root Cause(s):&lt;/STRONG&gt;&lt;UL&gt;&lt;LI&gt;&lt;SPAN&gt;More than 70% of forwarding destinations have failed. Ensure your hosts and ports in outputs.conf are correct. Also ensure that the indexers are all running, and that any SSL certificates being used for forwarding are correct.&lt;/SPAN&gt;&lt;/LI&gt;&lt;/UL&gt;&lt;/LI&gt;&lt;LI&gt;&lt;STRONG&gt;Last 50 related messages:&lt;/STRONG&gt;&lt;UL&gt;&lt;LI&gt;01-26-2021 14:55:56.254 +0300 WARN TcpOutputProc - Applying quarantine to ip=10.22.31.80 port=9997 _numberOfFailures=2&lt;/LI&gt;&lt;LI&gt;01-26-2021 14:55:56.253 +0300 INFO TcpOutputProc - Found currently active indexer. Connected to idx=10.22.22.241:9997, reuse=1.&lt;/LI&gt;&lt;LI&gt;01-26-2021 14:55:26.660 +0300 INFO TcpOutputProc - Connected to idx=10.22.22.241:9997, pset=0, reuse=0.&lt;/LI&gt;&lt;LI&gt;01-26-2021 14:55:26.553 +0300 INFO TcpOutputProc - _isHttpOutConfigured=NOT_CONFIGURED&lt;/LI&gt;&lt;LI&gt;01-26-2021 14:55:26.322 +0300 INFO TcpOutputProc - Group receiver initialized with maxQueueSize=512000 in bytes.&lt;/LI&gt;&lt;/UL&gt;&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;What does it mean? Thank you.&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jan 2021 11:58:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537199#M90038</guid>
      <dc:creator>bosseres</dc:creator>
      <dc:date>2021-01-26T11:58:38Z</dc:date>
    </item>
    <item>
      <title>Re: Error on forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537201#M90039</link>
      <description>&lt;P&gt;one more question, why can't I delete host from list? there is really no such host in outputs.conf&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="bosseres_0-1611662382550.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/12676i43EE85268428D249/image-size/medium?v=v2&amp;amp;px=400" role="button" title="bosseres_0-1611662382550.png" alt="bosseres_0-1611662382550.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jan 2021 12:00:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537201#M90039</guid>
      <dc:creator>bosseres</dc:creator>
      <dc:date>2021-01-26T12:00:33Z</dc:date>
    </item>
    <item>
      <title>Re: Error on forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537205#M90040</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228794"&gt;@bosseres&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;check the connection between Ds and Indexers because probably there a block between them.&lt;/P&gt;&lt;P&gt;You could use telnet:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;telnet 10.22.31.80 9997
telnet 10.22.22.241 9997&lt;/LI-CODE&gt;&lt;P&gt;If telnet fails, you can check:&lt;/P&gt;&lt;UL&gt;&lt;LI&gt;local firewall on DS,&lt;/LI&gt;&lt;LI&gt;firewalls between Ds and Indexers,&lt;/LI&gt;&lt;LI&gt;enabled receiving (on port 9997) on Indexers.&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jan 2021 12:58:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537205#M90040</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2021-01-26T12:58:16Z</dc:date>
    </item>
    <item>
      <title>Re: Error on forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537206#M90041</link>
      <description>&lt;P&gt;second one question I resolved with btool&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jan 2021 13:04:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537206#M90041</guid>
      <dc:creator>bosseres</dc:creator>
      <dc:date>2021-01-26T13:04:13Z</dc:date>
    </item>
    <item>
      <title>Re: Error on forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537207#M90042</link>
      <description>&lt;P&gt;we can close topic, I resolved the problem&lt;/P&gt;&lt;P&gt;ty&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jan 2021 13:05:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/537207#M90042</guid>
      <dc:creator>bosseres</dc:creator>
      <dc:date>2021-01-26T13:05:24Z</dc:date>
    </item>
    <item>
      <title>Re: Error on forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/711330#M117520</link>
      <description>&lt;P&gt;&amp;nbsp;Hi could you please tell me how did you resolve this issue as i am having the same issue as well.&lt;BR /&gt;Thank You.&lt;/P&gt;</description>
      <pubDate>Wed, 12 Feb 2025 05:42:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/711330#M117520</guid>
      <dc:creator>SN1</dc:creator>
      <dc:date>2025-02-12T05:42:00Z</dc:date>
    </item>
    <item>
      <title>Re: Error on forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/711332#M117521</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228794"&gt;@bosseres&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;&lt;P&gt;Please describe how you solved the topic and close the case for the oother people of the Community.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;&lt;P&gt;P.S.: Karma Points are appreciated &lt;span class="lia-unicode-emoji" title=":winking_face:"&gt;😉&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 12 Feb 2025 07:10:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/711332#M117521</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2025-02-12T07:10:22Z</dc:date>
    </item>
    <item>
      <title>Re: Error on forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/711333#M117522</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/274807"&gt;@SN1&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;&lt;P&gt;don't attach a new request to an old one, even if on the same topic, because probably you'll never receive an answer.&lt;/P&gt;&lt;P&gt;Open a new case describing your issue.&lt;/P&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
      <pubDate>Wed, 12 Feb 2025 07:11:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Error-on-forwarder/m-p/711333#M117522</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2025-02-12T07:11:54Z</dc:date>
    </item>
  </channel>
</rss>

