Getting Data In

How to troubleshoot error on Splunk 6 universal forwarder "TcpOutputProc - Forwarding to indexer group GSOC blocked for 9500 seconds."?

tiny3001
Path Finder

how to fix this error , "WARN TcpOutputProc - Forwarding to indexer group GSOC blocked for 9500 seconds". I cant receive security logs or any logs from my DC Servers, I am using SUF version 6 on a deployment Server

0 Karma
1 Solution

MuS
Legend

Hi tiny3001,

start troubleshooting why the queues are blocked. See the wiki http://wiki.splunk.com/Community:TroubleshootingBlockedQueues or use the S.o.S. App https://apps.splunk.com/app/748/ on the indexer. As well start to setup persistent queues on the UF http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Usepersistentqueues

cheers, MuS

View solution in original post

MuS
Legend

Hi tiny3001,

start troubleshooting why the queues are blocked. See the wiki http://wiki.splunk.com/Community:TroubleshootingBlockedQueues or use the S.o.S. App https://apps.splunk.com/app/748/ on the indexer. As well start to setup persistent queues on the UF http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Usepersistentqueues

cheers, MuS

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...