Deployment Architecture

Why am I getting errors on a search head with all their indexer IPs?

smdasim
Explorer

Hi Team,

I have configured a Splunk cluster with 1 search head ,1 cluster master and 1 license master/DS/MC and 3 indexers and 2 forwarders . (simple Splunk cluster environment )

I am not able to get data from forwarder to search head. All the configuration looks fine to me

Search query :
index=_internal log_level=ERROR

10-08-2018 11:51:50.723 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1195725856 bytes from src=83.65.96.175:50378 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

10-08-2018 11:47:19.866 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1195725856 bytes from src=177.188.19.79:46014 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

Any help will be appreciated .
thanks
Regards
smdasim

Tags (1)
0 Karma

hettervi
Builder

Hi smdasim! Did you find out the exact reason for the error messages? I've encountered the same issue when trying to send uncooked data from my deployment server to my indexer. It workes fine if sending the data cooked, but when I add "sendCookedData=false" to outputs.conf, the errors appear immediately.

0 Karma

ssadanala1
Contributor

Hi ,

Please look at answer below Hope if answers you question

https://answers.splunk.com/answers/438218/error-tcpinputproc-message-rejected-received-unexp.html

Please check tcp ports on indexers and validate output config on forwarder has same port on forwarder as well .

Make sure that indexer has tcp port enabled .

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...