unable to search index="_internal" for heavy forwarder instance from search head console but splunkd.log is functional

[Hemnaath]

Hi All, Suddenly I am unable to search the index="_internal" for all heavy forwarder instance from search head console. When checked in the splunk HF instances, could see /opt/splunk/etc/var/log/splunk/splunkd.log are getting updated but the same is not able to searched via splunk console.

I could see this message getting popped out in HF console .

"Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group all_indexers has been blocked for 10 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data"

Kindly guide me how to troubleshoot this issue.

[Hemnaath · Accepted solution]

Hi somesoni2, thanks for your effort, I hope the issue got fixed, we are able to search the index="_internal" for all heavy forwarder instance from search head console.

After restarting the splunk service the issue is fixed.

thanks for your effort.

[Hemnaath]

Hi All, Can any one guide me on this issue.
thanks in advance.

[somesoni2]

Few posts with similar issues.

https://answers.splunk.com/answers/395859/how-to-fix-error-forwarding-to-indexer-group-defau.html
https://answers.splunk.com/answers/337288/how-to-resolve-error-forwarding-to-indexer-group-d.html