This queue never gets smaller, only larger and eventually seems to cause a blockage of itself, aggqueue and typingqueue.
My question starts with what generates that "name=192.168.27.128_9997"? The only thing I know of that contains that string is my forwarder's $SPLUNK_HOME/etc/apps/search/local/outputs.conf file as the defaultGroup entry. The contents of the file are below and are a holdover from a 4.1.2 installation.
Either Splunk does not like your strange name (with all those numbers and dots/periods) or your indexers have SSL turned on and are listening on port 9998 in stead of port 9997. There are tools to check which ports have listeners (I do not know your OS) or you can just experiment (try changing your default group to use alpha-only). Here is another answer that shows a working pair of configuration files: http://answers.splunk.com/answers/110392/ssl-connection-between-indexer-and-forwarder.html