HI Team,
I have installed Splunk enterprise Indexers version 7.16 and Splunk UFD version 7.2.5 but I am seeing below errors in the logs and logs are not getting forwarded to Indexers. Can you please help with the fix
Errors on UFD:
04-24-2019 18:14:28.351 +0000 ERROR TcpOutputFd - Connection to host=10.10.10.1:9997 failed
04-24-2019 18:14:28.351 +0000 WARN TcpOutputProc - Applying quarantine to ip=10.10.10.1 port=9997 _numberOfFailures=2
04-24-2019 18:15:29.749 +0000 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 1300 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.
04-24-2019 18:18:49.772 +0000 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 1500 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data
Errors on Indexer:
04-24-2019 18:19:13.854 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=10.117.139.213:59565 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
04-24-2019 18:19:13.860 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=10.117.139.213:59570 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
