Auto Load Balanced TCP Output (error)

Path Finder


A network engineer recently modified the firewalls for the ports and we are getting this error messages in our search head, Cluster Manager, and Indexers: 

Auto Load Balanced TCP Output

Root Cause(s):

More than 70% of forwarding destinations have failed. Ensure your hosts and ports in outputs.conf are correct. Also ensure that the indexers are all running, and that any SSL certificates being used for forwarding are correct.

Labels (2)


Well, the message is relatively self-explanatory. Well-configured Splunk environment should send their logs to the indexers instead of storing them locally. For some reason in your case this fails.

Check your outputs.conf settings,see where the events should be sent and verify why it doesn't work (network connectivity, failed components, expired ssl certs...)

Check the splunkd.log on each of those components for symptoms nd additional info.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...