Getting Data In

Failed to resurrect x byte message!

eugenekogan
Explorer

I am seeing a continuous stream of error messages on one of my indexers, such as this sample:

03-13-2012 15:28:33.861 +0000 WARN  PipelineInputChannel - channel "source::C:\Program Files\SplunkUniversalForwarder/var/log/splunk/splunkd.log|host::DC-SERVER-21|SplunkUniversalForwarder/var/log/splunk/splunkd-2|remoteport::2239" ended without a done-key
03-13-2012 15:28:34.034 +0000 ERROR TcpInputProc - Failed to resurrect 954 byte message! from src=10.9.81.21:2238
03-13-2012 15:28:34.934 +0000 ERROR TcpInputProc - Failed to resurrect 1338 byte message! from src=10.9.81.21:2250
03-13-2012 15:28:36.890 +0000 ERROR TcpInputProc - Failed to resurrect 1290 byte message! from src=10.9.81.21:2258
03-13-2012 15:28:37.442 +0000 ERROR TcpInputProc - Failed to resurrect 1262 byte message! from src=10.9.81.21:2247
03-13-2012 15:28:37.810 +0000 ERROR TcpInputProc - Failed to resurrect 1290 byte message! from src=10.9.81.21:2259
03-13-2012 15:28:39.911 +0000 ERROR TcpInputProc - Failed to resurrect 1290 byte message! from src=10.9.81.21:2267

Any ideas on how to identify the problem? The forwarder is running on Windows. Thanks!

Tags (2)
0 Karma

wbfoxii
Communicator

Forwarder is sending compressed data and the indexer is expecting uncompressed? or vice-versa? make sure outputs.conf on the forwarder and inputs.conf on the indexer are configured properly.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...