https://community.splunk.com/t5/Getting-Data-In/Splunk-Not-indexing-data/m-p/189766#M98526 <P>Looks to me like you have a communication problem between the forwarder and the indexer.</P> <P>A number of potential issues:<BR /> Interface fault on the indexer<BR /> Local firewall on the indexer<BR /> Cable fault<BR /> Intervening firewall or connectivity broken altogether</P> <P>Have you tried to diagnose any of the above? If so how, and with what results?</P> Sun, 16 Mar 2014 12:17:00 GMT grijhwani 2014-03-16T12:17:00Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Not-indexing-data/m-p/189765#M98525 <P>Hello </P> <P>It looks like the HF's which are parsing our syslog data are not able to do it.</P> <P>I see all these errors. Any idea on why it can happen?</P> <PRE><CODE>03-15-2014 14:53:29.234 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer 03-15-2014 14:53:29.240 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer 03-15-2014 14:53:29.247 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer 03-15-2014 14:53:29.253 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer 03-15-2014 14:53:29.261 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer 03-15-2014 14:53:59.236 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer 03-15-2014 14:53:59.242 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer 03-15-2014 14:53:59.250 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer 03-15-2014 14:53:59.257 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer 03-15-2014 14:53:59.264 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer 03-15-2014 14:54:09.106 -0400 INFO DC:UpdateServerclassHandler - Changed state from=Phonehome to=HandlingPhonehome 03-15-2014 14:54:09.107 -0400 INFO DeployedServerclass - name=all_forwarder Reload; workingDir='/opt/splunk/var/run/all_forwarder' </CODE></PRE> Sat, 15 Mar 2014 19:43:02 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Not-indexing-data/m-p/189765#M98525 theouhuios 2014-03-15T19:43:02Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Not-indexing-data/m-p/189766#M98526 <P>Looks to me like you have a communication problem between the forwarder and the indexer.</P> <P>A number of potential issues:<BR /> Interface fault on the indexer<BR /> Local firewall on the indexer<BR /> Cable fault<BR /> Intervening firewall or connectivity broken altogether</P> <P>Have you tried to diagnose any of the above? If so how, and with what results?</P> Sun, 16 Mar 2014 12:17:00 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Not-indexing-data/m-p/189766#M98526 grijhwani 2014-03-16T12:17:00Z