topic Re: Need help with a Splunkd log message in Monitoring Splunk

Need help with a Splunkd log message

SN1 — Tue, 02 Dec 2025 13:12:39 GMT

this message is displaying in the splunkd logs on syslog server.
we are forwarding data from syslog server to DMZ server as we are getting logs from outside our network. And then to indexer.

Re: Splunkd

livehybrid — Tue, 02 Dec 2025 11:21:55 GMT

Hi @SN1

Are you able to confirm if the input queue was blocked on the receiving server (e.g. another HF or your indexer)? The log suggests that for a small period of time it could not connect to the indexer/HF.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Need help with a Splunkd log message

sb_garimella — Thu, 04 Dec 2025 07:37:32 GMT

Hey Hi,

I did encounter this issue a couple of times and it happened to be a connectivity issue where the Comms between source and destination wasn't enabled and firewall was blocking it. If this is the route taken: Syslog server -> DMZ server -> Indexers, then checking the following may help.

Please validate the connectivity between Syslog server and DMZ and ensure appropriate ports are open to receive the data on DMZ server. Please check if firewall is blocking it
Please verify the outputs.conf on the syslog server
Please validate the connectivity between DMZ server and Indexers .Please check if firewall is blocking it