will update you once rebooted the UF ... View more

Thanks for the reply. Actually we are not using any TLS or SSL connection from UF to Intermediate HF. When I run the ./spunk list forward-server, the HF is inactive. When I did the tcpdump, the HF is only sending SYN_RECV packets. Other UFs are established. Last resort would be rebooting the UF servers already. (I already reinstall the UF agent) Thanks, Balshore ... View more

Thanks for your reply. I’ve been reviewing the splunkd.log, specifically searching for keywords such as “blocked”, “full”, “tcpin”, “error”, and “warn”. However, I haven’t been able to find any logs indicating errors related to the UF. To provide more context, I have already successfully onboarded around 100 UFs, and this appears to be the only one encountering issues. I also removed the inputs on the UF side to help isolate whether this could be an ingestion-related issue, but the problem persists. Thanks, Balshore ... View more