Getting Data In

Why am I getting TcpOutputQ errors in forwarders splunkd.log?

krishnarajapant
Path Finder

Hi Team,

We are constantly getting below errors in forwarders splukd.log

ERROR TCPOutputQ - Unexpected event id=4

ERROR TCPOutputQ - Unexpected event id=7

However we have observed data is getting ingested to splunkindexers with out any issue. can any one please help us to understand what exactly this error is related to

 

With Regards,

Krishna.

Labels (1)
Tags (2)
0 Karma

krishnarajapant
Path Finder

hi Team,

Any updated?

below are the more logs.

(IP's in the below logs are intentionally masked)

 

06-11-2022 10:18:11.819 +0000 WARN TcpOutputProc - Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/health.log|host::XXXXXXXXXXX|splunkd|727, streamId=0, offset=0 on host=xxxxxxxx:9997
06-11-2022 10:18:11.819 +0000 WARN TcpOutputProc - Possible duplication of events with channel=source::/var/log/cron|host::xxxxxxxxxx|cron|637, streamId=0, offset=0 on host=XXXXXXXXXXXX:9997
06-11-2022 10:18:11.827 +0000 ERROR TcpOutputQ - Unexpected event id=2
06-11-2022 10:18:11.829 +0000 INFO TcpOutputProc - Connected to idx=xxxxxxxxxx:9997, pset=0, reuse=0. using ACK.
06-11-2022 10:18:11.829 +0000 ERROR TcpOutputQ - Unexpected event id=3
06-11-2022 10:18:11.829 +0000 ERROR TcpOutputQ - Unexpected event id=4

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...