Getting Data In

One UF isn't connecting to the indexer

gregbo
Communicator

One of my forwarders is not connecting with the indexers. Another system that is identical is connecting just fine. I keep getting errors about the message being rejected because it's too big, but I can't figure out where to adjust the allowed message size. This error is from the indexer:

03-04-2020 15:45:26.122 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=x.x.x.x:57186 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Compare outputs.conf on both the universal forwarders. Use btool command to list configurations and compare. Specially check if setting sendCookedData is set to false on UF which is not connecting. This error usually comes when a forwarder is sending uncooked data to indexer server.

./splunk cmd btool outputs list --debug

If sendCookedData = false change it to true and restart UF.

0 Karma

gregbo
Communicator

I checked, and both outputs.conf are identical (except for the sslPassword hash). Could it be something else? Is there a way to increase the "Maximum message size" that's mentioned in the error?

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

But a message can't be of size ~360MB. Looks like indexer is receiving uncooked data from forwarder. One way this happens when sendCookedData=false on UF.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...