Getting "forcibly closed by the remote host" splunkd.log errors after installing a Splunk 6.2.3 universal forwarder on Windows

[lanilim16]

This is the error from splunkd.log I get after installing 6.2.3 splunk forwarder in a Windows machine.

07-08-2015 11:28:56.555 -0400 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
07-08-2015 11:29:26.141 -0400 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
07-08-2015 11:29:31.502 -0400 INFO  TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
07-08-2015 11:29:56.146 -0400 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
07-08-2015 11:30:26.145 -0400 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
07-08-2015 11:30:51.182 -0400 WARN  TcpOutputProc - Forwarding to indexer group default-autolb-group blocked for 100 seconds.

outputs.conf looks like this

[tcpout]
indexAndForward=false
defaultGroup = default-group

[tcpout:default-group]
server = <host>:5543
compressed = true
autoLB = false

[tcpout-server://<host>:5543]

I don't know exactly where else to look.

[masonmorales]

The UF splunkd.log is telling you that the remote indexer (the one in your outputs.conf) is refusing its connection. Splunk will do this in certain scenarios where accepting data from the UF would be detrimental to system performance, such as when indexer congestion is present. You should look at SoS or DM on your indexer to determine the cause. You may want to open a Splunk Support case if you need assistance troubleshooting the indexer.