We have set up a new system with 6 indexers and 3 search heads, we have just barely started putting in data and we are consistently getting the above message on our indexers. Not sure how to trouble-shoot to fix this issue. There is a message just before it that says Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group all_indexers has been blocked for 10 seconds......
Any assistance would be appreciated.
1) Check indexers have enough space.
2) Check License should not cross daily limit.
3) Can you give outputs.conf
file configuration? Please check if you have only one server added below the autoLB = true
Also run
./splunk cmd btool check
to check any inconsistencies in the configuration files which might be causing it.