Please below. [root@prdpl2splunk02 bin]# ./splunk btool outputs list [rfs] batchSizeThresholdKB = 131072 batchTimeout = 30 compression = zstd compressionLevel = 3 dropEventsOnUploadError = false format = json format.json.index_time_fields = true format.ndjson.index_time_fields = true partitionBy = legacy [syslog] maxEventSize = 1024 priority = <13> type = udp [tcpout] ackTimeoutOnShutdown = 30 autoLBFrequency = 30 autoLBVolume = 0 blockOnCloning = true blockWarnThreshold = 100 cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256 compressed = false connectionTTL = 0 connectionTimeout = 20 defaultGroup = default-autolb-group disabled = false dropClonedEventsOnQueueFull = 5 dropEventsOnQueueFull = -1 ecdhCurves = prime256v1, secp384r1, secp521r1 enableOldS2SProtocol = false forceTimebasedAutoLB = false forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = _.* forwardedindex.2.whitelist = (_audit|_introspection|_telemetry) forwardedindex.filter.disable = false heartbeatFrequency = 30 indexAndForward = 0 maxConnectionsPerIndexer = 2 maxFailuresPerInterval = 2 maxQueueSize = 500KB negotiateProtocolLevel = 0 readTimeout = 300 secsInFailureInterval = 1 sendCookedData = true sslCommonNameToCheck = *.align.splunkcloud.com sslQuietShutdown = false sslVerifyServerCert = true sslVersions = tls1.2 tcpSendBufSz = 0 useACK = false useClientSSLCompression = true writeTimeout = 300 [tcpout-server://inputs1.stack.splunkcloud.com:9997] [tcpout-server://inputs15.stack.splunkcloud.com:9997] autoLBFrequency = 120 sslCommonNameToCheck = *.stack.splunkcloud.com sslVerifyServerCert = false sslVerifyServerName = false useClientSSLCompression = true [tcpout-server://inputs2.stack.splunkcloud.com:9997] [tcpout-server://inputs3.stack.splunkcloud.com:9997] [tcpout-server://inputs4.stack.splunkcloud.com:9997] [tcpout-server://inputs5.stack.splunkcloud.com:9997] [tcpout-server://inputs6.stack.splunkcloud.com:9997] [tcpout-server://inputs7.stack.splunkcloud.com:9997] [tcpout-server://inputs8.stack.splunkcloud.com:9997] [tcpout-server://inputs9.stack.splunkcloud.com:9997] [tcpout:default-autolb-group] disabled = false server = 54.85.90.105:9997, inputs2.stack.splunkcloud.com:9997, inputs3.stack.splunkcloud.com:9997,...... inputs15.stack.splunkcloud.com:9997 [tcpout:scs] compressed = true disabled = 1 server = stack.forwarders.scs.splunk.com:9997 UF Output: [rfs] batchSizeThresholdKB = 131072 batchTimeout = 30 compression = zstd compressionLevel = 3 dropEventsOnUploadError = false format = json format.json.index_time_fields = true format.ndjson.index_time_fields = true partitionBy = legacy [syslog] maxEventSize = 1024 priority = <13> type = udp [tcpout] ackTimeoutOnShutdown = 30 autoLBFrequency = 30 autoLBVolume = 0 blockOnCloning = true blockWarnThreshold = 100 cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256 compressed = false connectionTTL = 0 connectionTimeout = 20 defaultGroup = default-autolb-group disabled = false dropClonedEventsOnQueueFull = 5 dropEventsOnQueueFull = -1 ecdhCurves = prime256v1, secp384r1, secp521r1 enableOldS2SProtocol = false forceTimebasedAutoLB = false forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = _.* forwardedindex.2.whitelist = (_audit|_introspection|_internal|_telemetry|_configtracker) forwardedindex.filter.disable = false heartbeatFrequency = 30 indexAndForward = false maxConnectionsPerIndexer = 2 maxFailuresPerInterval = 2 maxQueueSize = auto readTimeout = 300 secsInFailureInterval = 1 sendCookedData = true sslQuietShutdown = false sslVersions = tls1.2 tcpSendBufSz = 0 useACK = false useClientSSLCompression = true writeTimeout = 300 [tcpout-server://prdpl2splunk02.domainame.com:9997] [tcpout:default-autolb-group] server = prdpl2splunk02.domainame.com:9997 ... View more

From UF installed:- [splunktcp] _rcvbuf = 1572864 acceptFrom = * connection_host = ip evt_dc_name = evt_dns_name = evt_resolve_ad_obj = 0 host = prdpl2bcl1101 index = default logRetireOldS2S = true logRetireOldS2SMaxCache = 10000 logRetireOldS2SRepeatFrequency = 1d route = has_key:tautology:parsingQueue;absent_key:tautology:parsingQueue Splunkcloud inputs machine: [root@servername bin]# ./splunk btool inputs list splunktcp [splunktcp] _rcvbuf = 1572864 acceptFrom = * connection_host = ip host = servername.aligntech.com index = default logRetireOldS2S = true logRetireOldS2SMaxCache = 10000 logRetireOldS2SRepeatFrequency = 1d route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:rulesetQueue;absent_key:_linebreaker:parsingQueue [splunktcp://9997] _rcvbuf = 1572864 connection_host = ip host = servername.aligntech.com index = default ... View more

Can you provide me ant suggestions to resolve this issue? ... View more