Hi,
i am not able to receive any data from my forwarder. It stopped working yesterday.port 9997 is open.connection is established.i can telnet to my server(which is my laptop).
here is the error from the splunkd from the forwarder
09-21-2017 15:20:51.293 -0400 WARN TcpOutputProc - Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 82200 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.
here is my input file from the forwarder server
[default]
host = HC1xxxxxxCV
[monitor://C:\Program Files (x86)\..........]
disabled = false
followTail = 0
sourcetype=Data Import
ignoreOlderThan = 6d
here is my outputs file from the forwarder
[tcpout]
defaultGroup = default-autolb-group
[tcpout-server://rs1-sbaba-t440.xxxxxxxx:9997]
[tcpout:default-autolb-group]
disabled = false
server = rs1-sbaba-t440.xxxxxxxxxxxxx:9997,rs1-sbaba-t440:9997
[tcpout-server://rs1-sbaba-t440:9997]
i checked on my laptop the reeving is enabled
this is my input file from the receiver
[default]
host = rs1-sbaba-t440
[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0
i read something about internal que being blocked.and set the stopacceptafterqblock attribute on inputs file which i dont see in my receivers inputs file(under local folder)never change the conf files under default folder.
i've been banging my head for hours and since i am stuck probably missing something very simple but can't find it.anyhelp is appreciated.
this thing was working fine till yesterday and now all of a sudden i am not bale to get data
thanks,
↧