Please check splunkd.log on manager node to check if there is any warning like: "05-15-2022 18:50:46.047 +0800 WARN TcpOutputProc [289743 indexerPipe] - The TCP output processor has paused the data flow. Forwarding to host_dest=centos8-5 inside output group my_peers_nodes from host_src=centos8-2 has been blocked for blocked_seconds=420. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data." I noticed that port 9997 on centos8-5 is not opened, once I turned it on the error went away.
... View more