Deployment Architecture

Splunk indexing is not working

manjunathaya
New Member

Team,

Geeting below error while indexing. Please let me know how can we fix this?

11-25-2019 07:39:35.796 -0500 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to host_dest=vc2crtp1428667np.fmr.com inside output group rtpindexer from host_src=vc2coma2429304n.fmr.com has been blocked
for blocked_seconds=600. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.

Tags (1)
0 Karma

oscar84x
Contributor

Do you have any forwarders working successfully, so that you can compare configurations?
What does your outputs and inputs look like?
Is the Indexer(s) expecting SSL?
Could also be a network issue, is the port open on the receiving end?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...