Splunk Enterprise

Index servers TcpInputProc error messages

fuster_j
Path Finder

I have 2 index servers that is LB and listening to port 9997. Both are getting a lot of this message in splunkd.log:

06-19-2012 10:23:59.920 ERROR TcpInputProc - Error encountered for connection from src=:. Timeout

Is it because the port 9997 is saturated? Do I need more index server to fix the issue? How do I debug it? Or, how can I determine if NIC TCP 9997 is saturated without installing 3rd party tool?

Tags (1)
0 Karma

athorat3
New Member

Getting a similiar error : default group property contains invalid group name

Any Luck with you guys?

0 Karma

ppriyanjith
New Member

I am also having the same setup(two indexes) and my listening port is 51099 and facing same issue. futher I can see below error message as well in forwader log

12-22-2012 22:54:53.703 +0000 INFO TcpOutputProc - tcpout group splunk_recieving_nodes using Auto load balanced forwarding
12-22-2012 22:54:53.703 +0000 INFO TcpOutputProc - Group splunk_recieving_nodes initialized with maxQueueSize=512000 in bytes.
12-22-2012 22:54:53.703 +0000 ERROR TcpOutputProc - the 'defaultGroup' property contains an invalid group name - splunk_recieving_nodes - skipping
12-22-2012 22:54:53.703 +0000 WARN TcpOutputProc - Default groupList has not yet been calculated!

can anyone help to resolve this issue

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...