2 of my indexer are configured but inactive state is showing . The data is not going to ingest in 2 indexers.

[Hemant93]

Two of my indexer is not working they are not receiving data from Universal forwarder.
when i run the command ./splunk display listen so it shows 9998 is listening and ./splunk list forward-server
gives the below result.

Active forwards:
10.246.250.154:9998 (ssl)

Configured but inactive forwards: 10.246.250.155:9998 10.246.250.156:9998

Let me know what i can do to activate the other two indexers

[richgalloway]

Is the forwarder logging any errors about failing to connect to the indexers?

[Hemant93]

@richgalloway 

we are getting these below error although splunk is up and running and configuration is also good

0-03-2023 08:04:43.963 -0400 ERROR TcpOutputFd [5866 TcpOutEloop] - Connection to host=10.246.250.154:9998 failed

10-04-2023 08:02:47.688 -0400 WARN  TcpOutputFd [3703313 TcpOutEloop] - Connect to 10.246.250.155:9998 failed. No route to host

10-04-2023 08:02:47.750 -0400 WARN  TcpOutputFd [3703313 TcpOutEloop] - Connect to 10.246.250.156:9998 failed. No route to host

[PickleRick]

This kind of errors typically show problems either on the network level (some firewall in the middle not allowing traffic from the UF to the indexers) or the host firewall on the indexer not allowing the incoming traffic.

[Hemant93]

we are getting these below error although splunk is up and running and configuration is also good

0-03-2023 08:04:43.963 -0400 ERROR TcpOutputFd [5866 TcpOutEloop] - Connection to host=10.246.250.154:9998 failed

10-04-2023 08:02:47.688 -0400 WARN  TcpOutputFd [3703313 TcpOutEloop] - Connect to 10.246.250.155:9998 failed. No route to host

10-04-2023 08:02:47.750 -0400 WARN  TcpOutputFd [3703313 TcpOutEloop] - Connect to 10.246.250.156:9998 failed. No route to host