Why am I getting errors on a search head with all their indexer IPs?

[smdasim]

Hi Team,

I have configured a Splunk cluster with 1 search head ,1 cluster master and 1 license master/DS/MC and 3 indexers and 2 forwarders . (simple Splunk cluster environment )

I am not able to get data from forwarder to search head. All the configuration looks fine to me

Search query :
index=_internal log_level=ERROR

10-08-2018 11:51:50.723 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1195725856 bytes from src=83.65.96.175:50378 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

10-08-2018 11:47:19.866 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1195725856 bytes from src=177.188.19.79:46014 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

Any help will be appreciated .
thanks
Regards
smdasim

[hettervik]

Hi smdasim! Did you find out the exact reason for the error messages? I've encountered the same issue when trying to send uncooked data from my deployment server to my indexer. It workes fine if sending the data cooked, but when I add "sendCookedData=false" to outputs.conf, the errors appear immediately.

[ssadanala1]

Hi ,

Please look at answer below Hope if answers you question

https://answers.splunk.com/answers/438218/error-tcpinputproc-message-rejected-received-unexp.html

Please check tcp ports on indexers and validate output config on forwarder has same port on forwarder as well .

Make sure that indexer has tcp port enabled .