just started learning splunk

[deepmis]

How do I resolve this error -> happens with both linux and mac

The TCP output processor has paused the data flow. Forwarding to host_dest=192.168.1.5 inside output group default-autolb-group from host_src=MacBook-Air.local has been blocked for blocked_seconds=10. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data

[gcusello]

Hi @deepmis,

the message you have means that the client cannot reach to send logs to the indexer because it's closed the connection.

At first a stupid question. di you enabled receiving on Indexer? on port 9997?

If yes, try using telnet to see if the connection is open from the client to the indexer:

telnet ip_indexer 9997

then verify that the IP addresses of your computers are in the same network.

Ciao.

Giuseppe

[saravanan90]

Mostly this could be firewall issue. Check the host firewall by connecting to destination server.
From forwarder we can telnet to destination to confirm the same

telnet indexer 9997

[deepmis]

There is no firewall .. its a home computer

[saravanan90]

Check the firewall communication.