Forwarder doest send events to Indexer after SSL activated. "ERROR pipeline"

Question

I have one Indexer (IDX) receiving data from one Heavy Forwarder (HF).

I configured SSL in both of them and now the Heavy Forwarder is not sending data to the Indexer. However the TCP connection is established between them when doing $ netstat -an.

I activated debug messages to appear on logs and I have the following error in "splunkd.log":

04-19-2012 09:51:10.129 +0100 ERROR pipeline - Runtime exception in pipeline: indexerPipe, processor: tcp-output-generic-processor, error: vector::_M_range_check

04-19-2012 09:51:10.129 +0100 ERROR splunklogger - Uncaught exception in pipeline execution (tcp-output-generic-processor) - getting next event

04-19-2012 09:51:11.010 +0100 DEBUG TcpOutputProc - Returning from sendPipelineData. No data available. here

My configurations are similar to the ones here:

http://wiki.splunk.com/Community:Splunk2Splunk_SSL_DefaultCerts

Thank you in advance

Accepted Answer

0

Problem solved!

It turns out the configuration at inputs.conf:

_TCP_ROUTING = server_port

didn't match with the configuration at outputs.conf:

_TCP_ROUTING = splunkssl

It was just a matter of setting that right by putting everything alike int both files.

link

answered 19 Apr '12, 02:42

fernandoandre
121●1●5
accept rate: 75%

hi is there any chance of any more detail on this? i've exactly the same problem but don't understand that resolution posted above? thanks in advance (and in anticipation)

(01 Aug '12, 09:03) rgill90

Hi rgill90, only saw your message today. I have one example as follows:

Inputs.conf [splunktcp://:9997] connection_host = ip _TCP_ROUTING = splunkssl

Outputs.conf [tcpout] defaultGroup = splunkssl

[tcpout:splunkssl] compressed = true server = <server>:9997 sslCertPath = ... sslPassword = ... sslRootCAPath = ... sslVerifyServerCert = true

As you can see, the attribute value at inputs.conf of _TCP_ROUTING is splunkssl and at the outputs you must have that same name at tcpout. Naturally you can give any name you want (no need to be "splunkssl" but they must match in both files)

(09 Aug '12, 02:28) fernandoandre

Forwarder doest send events to Indexer after SSL activated. "ERROR pipeline"

Follow this question

Splunk Resources

Related questions