Thanks a lot for replying..
I made required changes and restarted splunk
I am getting below message in var/logs/splunk
05-01-2018 11:14:19.763 +0530 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
05-01-2018 11:14:26.129 +0530 WARN TcpOutputProc - Cooked connection to ip=10.1.1.200:9997 timed out
05-01-2018 11:14:26.229 +0530 WARN TcpOutputProc - Cooked connection to ip=34.224.249.175:9997 timed out
05-01-2018 11:14:30.228 +0530 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
05-01-2018 11:14:39.727 +0530 WARN HttpPubSubConnection - Unable to parse message from PubSubSvr:
05-01-2018 11:14:39.727 +0530 INFO HttpPubSubConnection - Could not obtain connection, will retry after=77.394 seconds.
05-01-2018 11:14:42.229 +0530 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
... View more