Monitoring Splunk

Splunk Indexer Error

abhijitnath89ax
Loves-to-Learn

We received the below error in splunkd.log on our indexer server. We are using cluster env with 6 indexers. The indexers are coming up and down

11-05-2020 07:23:03.304 +0000 ERROR TcpInputProc - Error encountered for connection from src=X.X.X.X:60116. Broken pipe
Labels (2)
0 Karma

nwuest
Path Finder

Hi @abhijitnath89ax,

After doing some researching about the error you have depicted could be related to the indexers trying to see if the others indexers/receivers are "alive" named a heartbeat function.

View solution in original post by @hliakathali_spl 

 

Would there happen to be a firewall change either in the network and/or a firewall change on the Splunk Indexers themselves that are prohibiting the connection between them?

 
We hope to hear back from you!
 
V/R,
nwuest
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...