Splunk universal forwarder not able to send logs to Indexers

[pkumar9610]

HI Team,

I have installed Splunk enterprise Indexers version 7.16 and Splunk UFD version 7.2.5 but I am seeing below errors in the logs and logs are not getting forwarded to Indexers. Can you please help with the fix

Errors on UFD:
04-24-2019 18:14:28.351 +0000 ERROR TcpOutputFd - Connection to host=10.10.10.1:9997 failed
04-24-2019 18:14:28.351 +0000 WARN TcpOutputProc - Applying quarantine to ip=10.10.10.1 port=9997 _numberOfFailures=2
04-24-2019 18:15:29.749 +0000 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 1300 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.
04-24-2019 18:18:49.772 +0000 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 1500 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data

Errors on Indexer:

04-24-2019 18:19:13.854 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=10.117.139.213:59565 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
04-24-2019 18:19:13.860 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=10.117.139.213:59570 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

[gcusello]

Hi pkumar9610,
when you say Splunk Indexers version is 7.16, are you sayng 7.1.6?
if this is your situation, remember that UF version must be the same or older than Indexer version.
Bye.
Giuseppe

[pkumar9610]

I am able to telnet and nslookup from UFD to Indexer machine. And I can see 9997 port is also open on Indexer