Getting Data In
Highlighted

unable to search index="_internal" for heavy forwarder instance from search head console but splunkd.log is functional

Motivator

Hi All, Suddenly I am unable to search the index="_internal" for all heavy forwarder instance from search head console. When checked in the splunk HF instances, could see /opt/splunk/etc/var/log/splunk/splunkd.log are getting updated but the same is not able to searched via splunk console.

I could see this message getting popped out in HF console .

"Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group all_indexers has been blocked for 10 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data"

Kindly guide me how to troubleshoot this issue.

0 Karma
Highlighted

Re: unable to search index="_internal" for heavy forwarder instance from search head console but splunkd.log is functional

Motivator

Hi All, Can any one guide me on this issue.
thanks in advance.

0 Karma
Highlighted

Re: unable to search index="_internal" for heavy forwarder instance from search head console but splunkd.log is functional

SplunkTrust
SplunkTrust
Highlighted

Re: unable to search index="_internal" for heavy forwarder instance from search head console but splunkd.log is functional

Motivator

Hi somesoni2, thanks for your effort, I hope the issue got fixed, we are able to search the index="_internal" for all heavy forwarder instance from search head console.

After restarting the splunk service the issue is fixed.

thanks for your effort.

View solution in original post

0 Karma