The issues with HF and DC appear to be different ones. - The HF connectivity, it's connected but UF is not able to send data any more as the 10.236.65.143 is not accepting connection. The HF must be full in data processing queues all the way to the tcpoutput to another indexer(s). How to work around/make it better - if you have many HFs then try to configure asynchronous forwarding. Here's the info for your reference: https://www.linkedin.com/pulse/splunk-asynchronous-forwarding-lightning-fast-data-ingestor-rawat/?trk=public_profile_article_view - The DC connection issue, firstly check the configuration or add https:// to targetUri if it doesn't have it yet. Try to capture tcpdump and see why it fails - if it's by client side or by the DS. Or DNS failure..
... View more