Hello!
I am getting the following error:
Forwarding to indexer group default-autolb-group blocked for 2400 seconds.
I have configured inputs.conf to filter Windows events (System, Security etc..)
I have configured a heavy forwarder (with another SPLUNK instance)
My outputs.conf is:
[tcpout]
defaultGroup = default-autolb-group
indexAndForward = 0
[tcpout:default-autolb-group]
server = X.X.X.X:9997
[tcpout-server://X.X.X.X:9997]
Any ideas how to solve it?
Tnx in advance
Have you verified that port 9997 is open between the devices using something like telnet?
telnet x.y.z.a 9997
Should give you a blank screen with blinking cursor. You'll have to press ctrl + ] to break out of the telnet session. If you dont get the blank screen with blinking cursor, the port isnt open or the indexer isnt listening
On the indexer you can run netstat -an | grep 9997
to see if it's listening on the port.