Hey Hi, I did encounter this issue a couple of times and it happened to be a connectivity issue where the Comms between source and destination wasn't enabled and firewall was blocking it. If this is the route taken: Syslog server -> DMZ server -> Indexers, then checking the following may help. Please validate the connectivity between Syslog server and DMZ and ensure appropriate ports are open to receive the data on DMZ server. Please check if firewall is blocking it Please verify the outputs.conf on the syslog server Please validate the connectivity between DMZ server and Indexers .Please check if firewall is blocking it ... View more