Hello,
We are trying to send log data from PCF applications over to our Splunk indexers via TCP. This was configured and working fine on our old servers, but our new servers are throwing messages like:
06-24-2020 08:22:12.449 -0400 ERROR TcpInputProc - Message rejected. Received unexpected message of size=875640864 bytes from src=10.198.52.102:46154 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
We tried setting it up using the steps outlined here: https://docs.cloudfoundry.org/devguide/services/integratsplue-splunk.html#config by copying over the rfc5424 installation from our old servers to the new servers. The link to the Splunk documentation does not appear to work anymore, but I was not able to find additional information about how to integrate w/ PCF with a quick search in Splunk.
We have the ports configured in our inputs.conf file like this:
[tcp://6001]
connection_host = dns
index = test
sourcetype = rfc5424_syslog
But we continue to see these error messages. Is there some additional configuration we should be checking to make sure it is configured to accept this TCP data correctly?
Thanks in advance for any assistance.
