Splunk Enterprise

TCP output error after upgradation of HF

uagraw01
Motivator

Hello Splunkers!!

 

When i am upgrading my web HF from 8.0.0 to 8.1.2 then i am getting below error. Please let me what is available workaround for the below issue.

 

The TCP output processor has paused the data flow. Forwarding to host_dest=<indexer_name> inside output group splunkcloud from host_src=<HF_NAME> has been blocked for blocked_seconds=1970. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @uagraw01 

the target index queue is blocked check the indexer status using MC and do the necessary fix so the HF will start resuming forwarding events to indexers.

you can check the ./splunk list forward-server on HF is there are at least one active indexer.

--

An upvote would be appreciated if  this reply helps!

0 Karma

Stefanie
Builder

Probably not helpful but I have had this error a few times in the past. I just restart the Indexer and it works as normal. I don't know what causes this, I just fixed it. haha

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...