Getting Data In

The TCP output processor has paused the data flow

Wierengaaj
Loves-to-Learn

I recently transitioned to a new instance of Splunk and have been having some trouble configuring the new environment. 

I have 8 remote Windows hosts with identical forwarders (inputs.conf and outputs.conf are the same on all 8). 5 of the hosts are forwarding information correctly but 3 are reporting: "The TCP output processor has paused the data flow".

After reviewing some of the similar posts, it seems this error message is generic and just says there's nothing wrong with the forwarder, but there's something wrong with the server. 

I reviewed the monitoring console but didn't see anything that would indicate the server or index not having the ability to receive more information. 

Labels (1)
0 Karma

teunlaan
Contributor

Did you check firewall's?  If your forwarder can't connect the indexer, you get the same message

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...