Getting Data In

How to troubleshoot error on Splunk 6 universal forwarder "TcpOutputProc - Forwarding to indexer group GSOC blocked for 9500 seconds."?

tiny3001
Path Finder

how to fix this error , "WARN TcpOutputProc - Forwarding to indexer group GSOC blocked for 9500 seconds". I cant receive security logs or any logs from my DC Servers, I am using SUF version 6 on a deployment Server

0 Karma
1 Solution

MuS
Legend

Hi tiny3001,

start troubleshooting why the queues are blocked. See the wiki http://wiki.splunk.com/Community:TroubleshootingBlockedQueues or use the S.o.S. App https://apps.splunk.com/app/748/ on the indexer. As well start to setup persistent queues on the UF http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Usepersistentqueues

cheers, MuS

View solution in original post

MuS
Legend

Hi tiny3001,

start troubleshooting why the queues are blocked. See the wiki http://wiki.splunk.com/Community:TroubleshootingBlockedQueues or use the S.o.S. App https://apps.splunk.com/app/748/ on the indexer. As well start to setup persistent queues on the UF http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Usepersistentqueues

cheers, MuS

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...