One UF isn't connecting to the indexer

[gregbo]

One of my forwarders is not connecting with the indexers. Another system that is identical is connecting just fine. I keep getting errors about the message being rejected because it's too big, but I can't figure out where to adjust the allowed message size. This error is from the indexer:

03-04-2020 15:45:26.122 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=x.x.x.x:57186 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

[manjunathmeti]

Compare outputs.conf on both the universal forwarders. Use btool command to list configurations and compare. Specially check if setting sendCookedData is set to false on UF which is not connecting. This error usually comes when a forwarder is sending uncooked data to indexer server.

./splunk cmd btool outputs list --debug

If sendCookedData = false change it to true and restart UF.

[gregbo]

I checked, and both outputs.conf are identical (except for the sslPassword hash). Could it be something else? Is there a way to increase the "Maximum message size" that's mentioned in the error?

[manjunathmeti]

But a message can't be of size ~360MB. Looks like indexer is receiving uncooked data from forwarder. One way this happens when sendCookedData=false on UF.