Hello!
I am getting the following error:
Forwarding to indexer group default-autolb-group blocked for 2400 seconds.
I have configured inputs.conf to filter Windows events (System, Security etc..)
I have configured a heavy forwarder (with another SPLUNK instance)
My outputs.conf is:
[tcpout]
defaultGroup = default-autolb-group
indexAndForward = 0
[tcpout:default-autolb-group]
server = X.X.X.X:9997
[tcpout-server://X.X.X.X:9997]
Any ideas how to solve it?
Tnx in advance
↧