Auto Load Balanced TCP Output error


Hello All!

Hope everyone can help. After we upgrade our splunk enterpriste to 8.2 we are getting this messages errors in our search heads clusters regarding to our indexers.

Auto Load Balanced TCP Output

Root Cause(s):

More than 70% of forwarding destinations have failed. Ensure your hosts and ports in outputs.conf are correct. Also ensure that the indexers are all running, and that any SSL certificates being used for forwarding are correct.

Labels (2)
0 Karma


Please check splunkd.log on manager node to check if there is any warning like:

"05-15-2022 18:50:46.047 +0800 WARN TcpOutputProc [289743 indexerPipe] - The TCP output processor has paused the data flow. Forwarding to host_dest=centos8-5 inside output group my_peers_nodes from host_src=centos8-2 has been blocked for blocked_seconds=420. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data."

I noticed that port 9997 on centos8-5 is not opened, once I turned it on the error went away.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...