Splunk Not indexing data

[theouhuios]

Hello

It looks like the HF's which are parsing our syslog data are not able to do it.

I see all these errors. Any idea on why it can happen?

03-15-2014 14:53:29.234 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer
03-15-2014 14:53:29.240 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer
03-15-2014 14:53:29.247 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer
03-15-2014 14:53:29.253 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer
03-15-2014 14:53:29.261 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer
03-15-2014 14:53:59.236 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer
03-15-2014 14:53:59.242 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer
03-15-2014 14:53:59.250 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer
03-15-2014 14:53:59.257 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer
03-15-2014 14:53:59.264 -0400 ERROR TcpOutputFd - Read error. Connection reset by peer
03-15-2014 14:54:09.106 -0400 INFO  DC:UpdateServerclassHandler - Changed state from=Phonehome to=HandlingPhonehome
03-15-2014 14:54:09.107 -0400 INFO  DeployedServerclass - name=all_forwarder Reload; workingDir='/opt/splunk/var/run/all_forwarder'

[grijhwani]

Looks to me like you have a communication problem between the forwarder and the indexer.

A number of potential issues:
Interface fault on the indexer
Local firewall on the indexer
Cable fault
Intervening firewall or connectivity broken altogether

Have you tried to diagnose any of the above? If so how, and with what results?