Do you have a Splunk server listening on the URL in the error message? https://127.0.0.1:8089/services/data/inputs/http/http  I found this when the targetUri for the UF was not being correctly configured. ... View more

I'm getting exactly the same message using splunk/universalforwarder:8.2.1 ... View more

We found the problem: The user had exceeded his disk usage quota. And the fix: He went into his jobs and deleted a few, and then it worked. Hope this helps anyone in future! ... View more

Did you ever get to the bottom of this? We have a user who's experiencing the same problem. Whatever he seems to do, his searches are always queued with the date range set to "[01/01/1970 00:00:00.000 to 01/01/1970 01:00:00.000]". I'd really appreciate if you have any ideas to help. 🙂 ... View more