Hi, I am trying to inboard a new Syslog coming from a Syslog ng server but data is not indexing. Getting the below error in the internal logs in SH. ERROR TcpInputProc - Message rejected. Received unexpected message of size=369296128 bytes from src=xx.xx.xx.xx:xxxxx in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. Below is the path I have set for the incoming logs. Syslog-ng server > Universal Forwarder(TCP port) > Indexer Below are the configurations set at the forwarder end: inputs.conf [tcp://xxxxx] sourcetype=syslog index = Index_name disabled=false outputs.conf [tcpout] defaultGroup = ABC maxQueueSize = 7MB useACK = true [tcpout:ABC] server = index_server1:42000, index_server2:42000, index_server3:42000 # SSL SETTINGS sslCertPath = $SPLUNK_HOME/etc/auth/server.pem sslRootCAPath = $SPLUNK_HOME/etc/auth/ca.pem sslPassword = xxxx sslVerifyServerCert = true After the issue, I have tried to resolve it by setting the value of bucketRebuildMemoryHint to auto and manually both in the indexes.conf but it didn't work. indexes.conf [default] bucketRebuildMemoryHint = 569366123. Can anyone please advise me on this? Please let me know in case I am missing any information I missed to share which might help in reaching out to the solution. Thanks in Advance 🙂
... View more
