Splunk universal forwarder not able to send logs to Indexers

pkumar9610 — Wed, 24 Apr 2019 18:31:10 GMT

HI Team,

I have installed Splunk enterprise Indexers version 7.16 and Splunk UFD version 7.2.5 but I am seeing below errors in the logs and logs are not getting forwarded to Indexers. Can you please help with the fix

Errors on UFD:
04-24-2019 18:14:28.351 +0000 ERROR TcpOutputFd - Connection to host=10.10.10.1:9997 failed
04-24-2019 18:14:28.351 +0000 WARN TcpOutputProc - Applying quarantine to ip=10.10.10.1 port=9997 _numberOfFailures=2
04-24-2019 18:15:29.749 +0000 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 1300 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.
04-24-2019 18:18:49.772 +0000 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 1500 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data

Errors on Indexer:

04-24-2019 18:19:13.854 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=10.117.139.213:59565 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
04-24-2019 18:19:13.860 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=10.117.139.213:59570 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

Re: Splunk universal forwarder not able to send logs to Indexers

pkumar9610 — Wed, 24 Apr 2019 18:38:27 GMT

I am able to telnet and nslookup from UFD to Indexer machine. And I can see 9997 port is also open on Indexer

Re: Splunk universal forwarder not able to send logs to Indexers

gcusello — Thu, 25 Apr 2019 07:35:35 GMT

Hi pkumar9610,
when you say Splunk Indexers version is 7.16, are you sayng 7.1.6?
if this is your situation, remember that UF version must be the same or older than Indexer version.
Bye.
Giuseppe

topic Splunk universal forwarder not able to send logs to Indexers in Getting Data In

Splunk universal forwarder not able to send logs to Indexers

Re: Splunk universal forwarder not able to send logs to Indexers

Re: Splunk universal forwarder not able to send logs to Indexers