All queues show 100% as soon as system starts

[jrodj]

I'm very new to Splunk and working through the trial on Splunk Enterprise with a single server deployment. I appear to have done something that causes my server to think all queues are 100% full, but nothing is happening. I get messages:

WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 1150 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.

In the logs over and over but I don't see any data even coming into the server. Would love some help. The troubleshooting queues documentation was not helpful at all. I'm sure I've misconfigured something, but don't have any idea where to start.

[ddrillic]

Does anything reach the indexers? it seems that you don't have the connectivity.

[jgbricker]

That warning is referencing the output target group. It would be set in outputs.conf which would by default be at splunk_home/etc/system/default or local

If you are a single instance you shouldn’t have configured the outputs.conf because you don’t need to send you logs anywhere. It might be trying to send them off and having trouble and hitting queue limits.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf