How to solve this problem >Missing or malformed messages.conf stanza for TCPOUT:FORWARDING_BLOCKED___default-autolb-grou

[idris_tester]

Hi everybody !

How to solve this problem

>Missing or malformed messages.conf stanza for TCPOUT:FORWARDING_BLOCKED___default-autolb-group_DESKTOP-MOUI7DHDF_10

This prevents me from accessing the user and roles list page as an administrator, so I cannot invite new users.

Idris,

Thanks

[livehybrid]

Hi @idris_tester 

I don’t think this issue is preventing you from adding users. Does this instance have a Free license applied? The free license has limitations including no user management (see https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/configure-splunk-licenses/about-splunk-free )

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[idris_tester]

Hi @livehybrid , Thank you for your explanation. It seems that the cause is that the enterprise version I downloaded is a free license version. However, how can I upgrade it so that I can invite new users? I was invited to join the Splunk Private Bug Bounty program, and I need an account and license that can invite new users to test the website and API path. Thanks, Idris

[livehybrid]

Hi @idris_tester 

You should probably speak to the bounty program team to get a license provided, or see if you can change it to Trial license at https://yourSplunkInstance/en-US/manager/system/licensing

In order to access all the Splunk features you will need a full license. There are other license types available - see https://docs.splunk.com/Documentation/Splunk/9.4.2/Admin/TypesofSplunklicenses for more info and check out https://www.splunk.com/en_us/resources/personalized-dev-test-licenses/faq.html?locale=en_us for FAQs - However I think these dev/test licenses require a production paid license too. 

I think the best approach here is to speak to the people running the bounty program and see if they can provide you a proper license.

Also - you are running this locally (127.0.0.1) - Are your users able to access your server on a local IP?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[idris_tester]

Hi @livehybrid ,

Thank you for your helpful answers.

How do I change access from local (127.0.0.1) to public or non-local? Initially, I was able to invite new members (second account) and then access the second account through a different browser, and it had been working for two days, but this morning, the user feature access suddenly disappeared.

[PickleRick]

Check if your configuration contains errors.

/path/to/splunk btool check

 The messages.conf settings should not prevent you from loading the roles/users management sections of the ui however.

In what way it "prevents" you from adding users?

[idris_tester]

Hi @PickleRick ,

Sorry, I don't quite understand what you mean, but this is what happens in my localhost browser. Can you help me fix it?

Thanks,

Idris

[PrewinThomas]

@idris_tester 
-Can you check your outputs.conf for any invalid entries or missing config's.

-Check for any blocked errors highlighted in $SPLUNK_HOME/var/log/splunk/splunkd.log

Also check for any configuration conflicts or missing settings

$SPLUNK_HOME/bin/splunk btool outputs list --debug

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[idris_tester]

Hi @PrewinThomas 

I don't know how to check outputs.conf for invalid entries on my device. Could you please help provide some steps that will help me a lot, I will appreciate it.

Thanks,

Idris

[PrewinThomas]

@idris_tester 

No problem. Could you please share your basic architecture setup? Is it an All-In-One deployment?

Also, please run the command below on your Heavy Forwarder or All-In-One instance and provide the output (remember to mask any sensitive information).

$SPLUNK_HOME/bin/splunk btool outputs list --debug

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!