Hi James, Checks on the splunkd comes out this few errors 11-09-2021 22:18:40.901 +0800 WARN TailReader - Could not send data to output queue (parsingQueue), retrying... 11-09-2021 22:18:45.796 +0800 WARN TailReader - Could not send data to output queue (parsingQueue), retrying... 11-09-2021 22:18:50.100 +0800 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_192.168.x.xxx_8089_splunk-forwardersg.ifastfinancial.local_splunk-forwarder02_08A348A2-5753-4968-8FC4-F4477414E56B 11-09-2021 22:18:50.797 +0800 INFO TailReader - Continuing... 11-09-2021 22:18:50.901 +0800 INFO TailReader - ...continuing. 11-09-2021 22:18:54.746 +0800 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.x.xxx:9997, reuse=1. 11-09-2021 22:18:55.956 +0800 WARN TailReader - Could not send data to output queue (parsingQueue), retrying... 11-09-2021 22:19:05.957 +0800 INFO TailReader - ...continuing. 11-09-2021 22:19:10.801 +0800 WARN TailReader - Could not send data to output queue (parsingQueue), retrying... 11-09-2021 22:19:20.802 +0800 INFO TailReader - Continuing... 11-09-2021 22:19:24.638 +0800 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.x.xxx:9997, reuse=1. Connection from Heavy forwarder to indexer is fine, Trying 192.168.x.xx... Connected to 192.168.x.xxx. Escape character is '^]'. ^] 11-09-2021 23:30:07.713 +0800 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.x.xxx:9997, reuse=1. 11-09-2021 23:30:37.607 +0800 INFO TcpOutputProc - Found currently active indexer. Connected to idx=192.168.x.xxx:9997, reuse=1.
... View more