Hi,
Seeking you inputs to achieve the below scenario.
Scenario
Both Splunk and RSA Netwitness is installed in AWS environment, VPCID of both is same and all inbound and outbound traffic is allowed. Have uploaded few csv files of various devices. Requirement is to forward the events + raw logs from Splunk to RSA NW component.
I have configured the forwarding through Splunk GUI, :514. Post configuring this forwarding one outputs.conf file created in splunk local directory. Have added a syntax “sendCookedData=false” in outputs.conf file. Also tried with forwarding port 6996.
But nothing is working and getting error “The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 3880 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.”
Could any please help me with the configuration part which I missed in splunk end.
