Hi All, Suddenly I am unable to search the index="_internal" for all heavy forwarder instance from search head console. When checked in the splunk HF instances, could see /opt/splunk/etc/var/log/splunk/splunkd.log are getting updated but the same is not able to searched via splunk console.
I could see this message getting popped out in HF console .
"Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group all_indexers has been blocked for 10 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data"
Kindly guide me how to troubleshoot this issue.
↧