Auto Load Balanced TCP Output error


Hello All!

Hope everyone can help. After we upgrade our splunk enterpriste to 8.2 we are getting this messages errors in our search heads clusters regarding to our indexers.

Auto Load Balanced TCP Output

Root Cause(s):

More than 70% of forwarding destinations have failed. Ensure your hosts and ports in outputs.conf are correct. Also ensure that the indexers are all running, and that any SSL certificates being used for forwarding are correct.

Labels (2)
0 Karma


Please check splunkd.log on manager node to check if there is any warning like:

"05-15-2022 18:50:46.047 +0800 WARN TcpOutputProc [289743 indexerPipe] - The TCP output processor has paused the data flow. Forwarding to host_dest=centos8-5 inside output group my_peers_nodes from host_src=centos8-2 has been blocked for blocked_seconds=420. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data."

I noticed that port 9997 on centos8-5 is not opened, once I turned it on the error went away.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...