Hello Paul,
Sorry for this late reply. I’ll take your concern in two aspects & shall reply inline to both of them.
1) The grammatical error in the error that you see over there.
-> Infoblox would fix that grammatical error & change it to something like ‘Forwarder is running but it fails to connect to ANY of the indexers’. The tentative releases which shall include this change is 8.5.0/8.4.3 & later.
2) Is that error expected to be there, having the indexer removed from your Grid ?
-> That’s expected when the indexer is unavailable & a Splunk Forwarder instance is running on your Grid members. Infoblox added an enhancement to include the error, ‘Forwarder is running but it fails to connect to none of the indexers’ from NIOS version 8.x & later. A script regularly runs on the grid forwarder instances (non-reporting Grid members & grid master) to check for the message “ERROR TcpOutputFd - Connection to host=x.x.x.x:9997 failed” in its own splunkd.log file. The output of the above script is updated to a text file within the Splunk forwarder. If the output in the file mentioned above indicates that the connection to ALL the indexers has FAILed(Like in case we have a cluster setup), then the status ‘Forwarder is running but it fails to connect to NONE of the indexers’ is reported by that specific forwarder in the GUI.
Hope that’s helpful!
Best regards.
