Splunk forwarder not sending data to Indexer server

[uagraw01]

Hello Team,

I have configured splunk forwarder and on which I am getting below error,

WARN TcpOutputProc [8204 parsing] - The TCP output processor has paused the data flow. Forwarding to host_dest=WALVAU-VIDI-1 inside output group default-autolb-group from host_src=WALVAU-MCP-APP- has been blocked for blocked_seconds=400. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.

Task : I want to send data from Splunk forwarder to Splunk enterprise server ( Indexer )

1.  I opened outbound port on UF 9997

2. Opened inbound port 9997 on indexer

outputs.conf on UF

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = WALVAU-VIDI-1:9997

[tcpout-server://WALVAU-VIDI-1:9997]

inputs.conf on UF

[monitor://D:\BEXT\Walmart_VAU_ACP\Log\BPI*.log]
disabled = false
index = walmart_vau_acp
sourcetype = Walmart_VAU_ACP

Please help me to fix the issue. So that forwarder will send data to Indexer server.

[uagraw01]

@inventsekar @deepakc I have attached below screenshot and its showing the correct port opened and listening perfectly. Please validate at once.

ON Indexer

On UF

On indexer

On UF

[inventsekar]

Hi @uagraw01 

1) pls check if all good with license.. do you see any warnings/errors related to license?

2) On the forwarder, pls check this:

$SPLUNK_HOME/bin/splunk btool outputs list --debug

3) On the indexer, pls check this:

$SPLUNK_HOME/bin/splunk btool inputs list --debug

(if $SPLUNK_HOME not setup properly, then add the exact path, like /opt/splunk)

4) from the UF, try to ping the indexer

5) from the UF, pls try to telnet the indexer at the receiving port

[deepakc]

This could be a number of things causing issues, that said tcp ouput is normally something related to the network or setup.

A few things to check:

What does the inputs.conf look like on your indexer?

Check on the indexer the port - should show your configured port 9997
netstat -tupln

Is there a firewall blocking this port?

Can your UF communicate to Indexer?