Hello,
Configured an Indexer to send the data to a Heavy forwarder.
I am able to telnet to the heavyforwarder with port XXXX from indexer without any issue.
The following is my outputs.conf in Indexer :-
[tcpout]
defaultGroup = dev_null
indexAndForward = true
forwardedindex.filter.disable = true
[tcpout:server_output]
dropEventsOnQueueFull = 10
maxQueueSize = 50MB
server = xyz.com:zzzz
sendCookedData = false
clientCert = XXXXX
useACK = false
sslPassword = YYYYY
As specified above xyz.com is my heavy forwarder where I am trying to forward the data from indexer
The following is my inputs.conf in heavy forwarder(xyz.com)
[splunktcp]
route=has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:typingQueue;absent_key:_linebreaker:parsingQueue
[splunktcp-ssl:XXXX]
queueSize = 100MB
[SSL]
serverCert = XXXXXXX
requireClientCert = true
sslPassword = XXXXX
Now I am seeing the following ERROR in Heavy forwarder's splunkd.log
ERROR TcpInputProc - Message rejected. Received unexpected message of size=842019376 bytes from src=X.X.X.X:YYYY in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
Any idea on how this can be resolved and have a data transfer from indexer to heavy forwarder?
Also, The data that I'm trying to transfer from indexer is not that huge. Doesn't make any sense on the high vollume error message.
Input splunktcp-ssl expects parsed data from sender but you have set sendCookedData to false in outputs.conf on indexer server. You need to set this attribute to true.
Input splunktcp-ssl expects parsed data from sender but you have set sendCookedData to false in outputs.conf on indexer server. You need to set this attribute to true.