New to Splunk, Fresh 7.1 install, "0400 WARN TcpOutputProc - Tcpout Processor" error.

[jross19]

The following error repeats every 20 seconds in the Health Status of Splunkd message box. Splunk is not pulling any data after initial installation and I suspect this is a good place to start. I have search for a few hours with no luck.

•05-24-2018 10:32:13.184 -0400 WARN TcpOutputProc - Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 700 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.

Any help would be greatly appreciated. If additional information is need please advise.

Justin

[Azeemering · Accepted solution]

1) check indexers have enough space.
2) check License should not cross daily limit.

Also check if you have set your outputs.conf correctly:
http://docs.splunk.com/Documentation/Forwarder/7.1.0/Forwarder/Configureforwardingwithoutputs.conf

[jross19]

After restarting all the VMs being monitored the error when away. I think too much info was shutting down the application. It is up now.