Getting Data In

splunkd.log errors attempting to send PCF data via TCP

SPlunkQR
Explorer

Hello,

We are trying to send log data from PCF applications over to our Splunk indexers via TCP. This was configured and working fine on our old servers, but our new servers are throwing messages like:

06-24-2020 08:22:12.449 -0400 ERROR TcpInputProc - Message rejected. Received unexpected message of size=875640864 bytes from src=10.198.52.102:46154 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

We tried setting it up using the steps outlined here: https://docs.cloudfoundry.org/devguide/services/integratsplue-splunk.html#config by copying over the rfc5424 installation from our old servers to the new servers. The link to the Splunk documentation does not appear to work anymore, but I was not able to find additional information about how to integrate w/ PCF with a quick search in Splunk.

We have the ports configured in our inputs.conf file like this:

[tcp://6001]
connection_host = dns
index = test
sourcetype = rfc5424_syslog

But we continue to see these error messages. Is there some additional configuration we should be checking to make sure it is configured to accept this TCP data correctly?

Thanks in advance for any assistance.

Labels (3)
Tags (4)
0 Karma

splunkcol
Builder

same problem here

 

08-05-2020 19:16:25.857 -0500 ERROR TcpInputProc - Message rejected. Received unexpected message of size=774796916 bytes from src=192.xxx.x.xx:64052 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...