Hi All, Suddenly I am unable to search the index="_internal" for all heavy forwarder instance from search head console. When checked in the splunk HF instances, could see /opt/splunk/etc/var/log/splunk/splunkd.log are getting updated but the same is not able to searched via splunk console.
I could see this message getting popped out in HF console .
"Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group all_indexers has been blocked for 10 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data"
Kindly guide me how to troubleshoot this issue.
Hi All, Can any one guide me on this issue.
thanks in advance.
Hi somesoni2, thanks for your effort, I hope the issue got fixed, we are able to search the index="_internal" for all heavy forwarder instance from search head console.
After restarting the splunk service the issue is fixed.
thanks for your effort.