Why is my HF unable to forward events?

[dionrivera]

My HF stopped forwarding events. So far:

1. The splunkd service is running 

2. no firewalls enabled

3. Running this command is successful which I think means I'm connecting to the indexers

              $ ./bin/splunk cmd openssl s_client -connect inputs1.<stack>.splunkcloud.com:9997

4. Tried restarting the service with no success. 

5. the splunkd.log file on the HF is reporting a lot of ERROR TcpInputProc errors

Help! Thank you

Any suggestions would be appreciated

[SinghK]

Check this link:

https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-error-quot-ERROR-TcpInputProc-Error-e... 

[isoutamo]

Could it be that your TLS certs has changed on server side and for that reason it cannot really connect with HF but seems to work with openssl?
What kind of errors you have in splunkd.log on HF side?

[dionrivera · Accepted solution]

@isoutamo  As it turns out the hostname on my HF had changed which caused it to lose connection to my Deployment Server. When it lost connection the deploymentclient app was not pushed out to the HF so it did not know how to talk to Splunk cloud. I have re-deployed the correct app and now I'm connecting. Thank you.

[venkatasri]

• Did you check forwarders are active? There must be at least one active forwarder (aka indexer from HF).

./splunk list forward-server

•  restarting should clear the queues temporarily they may get blocked again if indexers are busy receiving data. https://wiki.splunk.com/Community:TroubleshootingBlockedQueues
• Make sure your forwarders are monitoring correctly and connected to HF.  (HF must be under active forwarder list when you execute same command on UF)