Thanks for your reply @sainag_splunk I have done some tests and checks. For the load, I do not think it is too much data, I increased the number of heavy forwarders from 2 to 4 it did not make any change. For the TLS/SSL, The instance with the UF supports SSLv3 TLSv1 TLSv1.2 TLSv1.3 The load balancer (LB) (the HF are behind the LB) support TLS 1.2 and 1.3 To eliminate the LB I pointed the UF directly to the HF by changing the outputs.conf as follows uri = http://<ip-of-hf>:8088 It did not work in the environment with UF v9.3.1 and HF v9.3.1 , with the same error. Telnet from UF to HF on port 8088 worked However this (direct to HF) worked in the environment with UF v9.3.1 and HF v9.1.2 Also I noticed that the restart of UF in the environment with the problem is very slow, it takes 4-5 minutes, In the environment with no issues it takes a couple of seconds. Output and input configs look similar.
... View more