Why am I getting TcpOutputQ errors in forwarders splunkd.log?

[krishnarajapant]

Hi Team,

We are constantly getting below errors in forwarders splukd.log

ERROR TCPOutputQ - Unexpected event id=4

ERROR TCPOutputQ - Unexpected event id=7

However we have observed data is getting ingested to splunkindexers with out any issue. can any one please help us to understand what exactly this error is related to

With Regards,

Krishna.

[krishnarajapant]

hi Team,

Any updated?

below are the more logs.

(IP's in the below logs are intentionally masked)

06-11-2022 10:18:11.819 +0000 WARN TcpOutputProc - Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/health.log|host::XXXXXXXXXXX|splunkd|727, streamId=0, offset=0 on host=xxxxxxxx:9997
06-11-2022 10:18:11.819 +0000 WARN TcpOutputProc - Possible duplication of events with channel=source::/var/log/cron|host::xxxxxxxxxx|cron|637, streamId=0, offset=0 on host=XXXXXXXXXXXX:9997
06-11-2022 10:18:11.827 +0000 ERROR TcpOutputQ - Unexpected event id=2
06-11-2022 10:18:11.829 +0000 INFO TcpOutputProc - Connected to idx=xxxxxxxxxx:9997, pset=0, reuse=0. using ACK.
06-11-2022 10:18:11.829 +0000 ERROR TcpOutputQ - Unexpected event id=3
06-11-2022 10:18:11.829 +0000 ERROR TcpOutputQ - Unexpected event id=4