"ERROR TcpInputProc - Message rejected" error in heavy forwarder's splunkd.log when trying to receive events from Indexer.

[pavanae]

Hello,

Configured an Indexer to send the data to a Heavy forwarder.

I am able to telnet to the heavyforwarder with port XXXX from indexer without any issue.

The following is my outputs.conf in Indexer :-

[tcpout]
defaultGroup = dev_null
indexAndForward = true
forwardedindex.filter.disable = true

[tcpout:server_output]
dropEventsOnQueueFull = 10
maxQueueSize = 50MB
server = xyz.com:zzzz
sendCookedData = false
clientCert = XXXXX
useACK = false
sslPassword = YYYYY

As specified above xyz.com is my heavy forwarder where I am trying to forward the data from indexer

The following is my inputs.conf in heavy forwarder(xyz.com)

[splunktcp]
route=has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:typingQueue;absent_key:_linebreaker:parsingQueue

[splunktcp-ssl:XXXX]
queueSize = 100MB

[SSL]
serverCert = XXXXXXX
requireClientCert = true
sslPassword = XXXXX

Now I am seeing the following ERROR in Heavy forwarder's splunkd.log

 ERROR TcpInputProc - Message rejected. Received unexpected message of size=842019376 bytes from src=X.X.X.X:YYYY in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

Any idea on how this can be resolved and have a data transfer from indexer to heavy forwarder?

Also, The data that I'm trying to transfer from indexer is not that huge. Doesn't make any sense on the high vollume error message.

[manjunathmeti · Accepted solution]

Input splunktcp-ssl expects parsed data from sender but you have set sendCookedData to false in outputs.conf on indexer server. You need to set this attribute to true.