The tcp output processor has paused the dataflow and input.conf config problems

[Simons20]

I have a couple of questions.

- I have my searchhead and indexer on the same server.

I know that my domain controllers and the universal forwarders on it are installed correctly

I'm receiving AD data en securityeventlogs in splunk.

However every search with Splunk app for windows infrastructures will came up empty

- beside that is the performance of my splunk instance very slow and now  i have the error messages: the tcp output processor has paused the dataflow forwarding to host_dest= etc......

Now it seems that i'm don't receive data anymore. It happened after i putted an input.conf in de app for windows infrastructure local folder.

After I removed it i still don't receive any data.

I'm stuck now. What can i do to fix

- the performance issues

- that i don't receive data anymore

- that the app for windows infrastructure will be working ( i really followed every step and all was checked green @ the setup).

THanks for helping me

[richgalloway]

We need more information.

Regarding performance: what hardware (# CPUs, amount of memory, etc) is Splunk running on?  Which platform?  How much data is being ingested?  How many concurrent searches are running?

Regarding receiving data: Have you checked your firewalls?  Is the indexer still receiving on port 9997?  What are the inputs.conf and outputs.conf settings on the UF?  Have you verified you have the data the Splunk App for Infrastructure expects?  Are you using the Splunk Add-on for Infrastructure?