https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/396697#M6234 <P>We are currently getting the below errors on our splunk Indexers and are every few hours the splunk indexer cluster is placed in to quarantine by the Heavy Forwarders. We have two heavy forwarders inbound to 3 indexers in index cluster. Looking over the logs these are the only errors that we are receiving. </P> <P>04-01-2019 23:41:19.706 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|263011": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:51090.<BR /> 04-01-2019 23:41:19.963 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|273702": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-ip]:51086.<BR /> 04-01-2019 23:41:44.349 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|235289": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:51022.<BR /> 04-01-2019 23:41:48.991 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|1839654": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:59700.<BR /> 04-01-2019 23:41:49.075 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|2761310": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:59702.<BR /> 04-01-2019 23:42:18.862 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|1839654": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:59742.<BR /> 04-01-2019 23:42:18.875 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|1839654": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:59744.</P> Wed, 30 Sep 2020 00:01:02 GMT galwood 2020-09-30T00:01:02Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/396697#M6234 <P>We are currently getting the below errors on our splunk Indexers and are every few hours the splunk indexer cluster is placed in to quarantine by the Heavy Forwarders. We have two heavy forwarders inbound to 3 indexers in index cluster. Looking over the logs these are the only errors that we are receiving. </P> <P>04-01-2019 23:41:19.706 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|263011": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:51090.<BR /> 04-01-2019 23:41:19.963 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|273702": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-ip]:51086.<BR /> 04-01-2019 23:41:44.349 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|235289": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:51022.<BR /> 04-01-2019 23:41:48.991 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|1839654": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:59700.<BR /> 04-01-2019 23:41:49.075 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|2761310": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:59702.<BR /> 04-01-2019 23:42:18.862 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|1839654": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:59742.<BR /> 04-01-2019 23:42:18.875 +0000 ERROR TcpInputProc - Encountered Streaming S2S error=Cannot register new_channel="source::[log location]|host::[hostname]|sourcetype::iis|1839654": desired_field_count=19 conflicts with existing_field_count=0 for data received from src=[HF-IP]:59744.</P> Wed, 30 Sep 2020 00:01:02 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/396697#M6234 galwood 2020-09-30T00:01:02Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/396698#M6235 <P>We have the exact same issue but no solution for you. I wanted to add to the thread to perhaps bring this back into view.</P> Tue, 16 Jul 2019 17:13:15 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/396698#M6235 timpacl 2019-07-16T17:13:15Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/396699#M6236 <P>Same issue with us, were either of you able to resolve?</P> Fri, 10 Apr 2020 21:44:04 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/396699#M6236 amartin6 2020-04-10T21:44:04Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/396700#M6237 <P>Try changing the sourcetype to ms:iis</P> <P>I had the same issue and from looking through the deployment app I noticed that the sourcetype was forced as iis and the props was looking for ms:iis. I am assuming you are using the TA for Windows IIS as well.</P> Wed, 15 Apr 2020 16:50:59 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/396700#M6237 mherbeck 2020-04-15T16:50:59Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/703860#M10543 <P>See&nbsp;<A href="https://community.splunk.com/t5/Knowledge-Management/Persistent-queue-problems/td-p/703859" target="_blank">https://community.splunk.com/t5/Knowledge-Management/Persistent-queue-problems/td-p/703859</A></P> Fri, 08 Nov 2024 00:22:04 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-TcpInputProc-Error-causing-possible-outage/m-p/703860#M10543 hrawat 2024-11-08T00:22:04Z