I am trying to forward raw data to a none-splunk system by adding an entry at Manager » Forwarding and receiving » Forward data e.g. 10.50.1.1:1111
I also set the option "Yes" in store a local copy of forwarded events.
However, after restarting the splunk server, I don't see any new events get indexed on the splunk UI. On top of, I saw the message "skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied."
Once I deleted the entry in "Forward data", everything is back to normal.
Please note this splunk server is receiving 200 events per second from splunkuniversalforwarder.
Please shed some light on this. Thanks in advance!!!
Error in splunk/var/log/splunk/splunkd.log
11-16-2012 16:38:25.282 -0500 ERROR splunklogger - Uncaught exception in pipeline execution (tcp-output-generic-processor) - getting next event
11-16-2012 16:38:25.283 -0500 ERROR pipeline - Runtime exception in pipeline: indexerPipe, processor: tcp-output-generic-processor, error: vector::Mrange_check
This would be a valid method if you were attempting to forward data to a Splunk indexer. However, since you are sending to a 3rd-party system, this will not work. Since your forwarding system does not recognize the receiving system as Splunk, forwarding will not take place. This document explains how you should configure forwarding to a non-Splunk system: