About tcador

tcador · ‎06-24-2014

I should have mentioned this in the original question. I have checked/verified connectivity between the forwarder and indexer and do not see any issues. Are there any configurations on either end that I could be missing?

tcador · ‎06-23-2014

Hello, Seeing this WARN log message roughly every 1-2 minutes on forwarders sending logs with ACK enabled to two separate indexers. WARN TcpOutputProc - Read operation timed out expecting ACK from x.x.x.x:9997 in 300 seconds. Also seeing these around the same time: TcpOutputProc - Possible duplication of events with channel=source::my_source_file_path|host::my_host_name|encrypted|49628, streamId=1484623843723112376, offset=32768 on host=x.x.x.x:9997 I am also seeing about 5% duplication of events.

tcador · ‎02-11-2014

Was there ever an answer to this? I'm in the same situation as this: "Ideally I'd have all the scripting run on the single indexer from the variable number of forwarder-provided-data. Is that possible? E.g. forwarder sends raw log -> indexer -> decode log from forwarder(s) -> index"

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-29-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

splunkd: Read operation timed out expecting ACK fr...

Re: splunkd: Read operation timed out expecting AC...

splunkd: Read operation timed out expecting ACK fr...

Re: Transform log file or field at index time usin...