How do I resolve this error -> happens with both linux and mac
The TCP output processor has paused the data flow. Forwarding to host_dest=192.168.1.5 inside output group default-autolb-group from host_src=MacBook-Air.local has been blocked for blocked_seconds=10. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data
Hi @deepmis,
the message you have means that the client cannot reach to send logs to the indexer because it's closed the connection.
At first a stupid question. di you enabled receiving on Indexer? on port 9997?
If yes, try using telnet to see if the connection is open from the client to the indexer:
telnet ip_indexer 9997
then verify that the IP addresses of your computers are in the same network.
Ciao.
Giuseppe
Mostly this could be firewall issue. Check the host firewall by connecting to destination server.
From forwarder we can telnet to destination to confirm the same
telnet indexer 9997
There is no firewall .. its a home computer
Check the firewall communication.