Hi ammul440, the error you report says that you have to open firewall routes between targets and Splunk server on port 9997 for data and on 8089 for management (if you use Splunk server also as a Deployment server. This is always the first check to do before to install a Universal Forwarder. About the search I suggested, it has the objective to see if the target is connected to the Indexer. I don't understand when you speak of a "separate node", target and Splunk server are on the same server? Ciao. Giuseppe ... View more

yes i have tried setting this also. but still i could not see anything ... View more

The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 10 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. Learn more. can anyone help me with this error. I am unable to forward the logs to splunk server ... View more