Auto Load Balanced TCP Output error


Hello All!

Hope everyone can help. After we upgrade our splunk enterpriste to 8.2 we are getting this messages errors in our search heads clusters regarding to our indexers.

Auto Load Balanced TCP Output

Root Cause(s):

More than 70% of forwarding destinations have failed. Ensure your hosts and ports in outputs.conf are correct. Also ensure that the indexers are all running, and that any SSL certificates being used for forwarding are correct.

Labels (2)
0 Karma


Please check splunkd.log on manager node to check if there is any warning like:

"05-15-2022 18:50:46.047 +0800 WARN TcpOutputProc [289743 indexerPipe] - The TCP output processor has paused the data flow. Forwarding to host_dest=centos8-5 inside output group my_peers_nodes from host_src=centos8-2 has been blocked for blocked_seconds=420. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data."

I noticed that port 9997 on centos8-5 is not opened, once I turned it on the error went away.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...