topic TCPOutAutoLB-0 after installing UF credentials from Splunk cloud in Splunk Cloud Platform

TCPOutAutoLB-0 after installing UF credentials from Splunk cloud

ejose — Thu, 10 Apr 2025 12:29:31 GMT

Hi,

We have Splunk Enterprise 9.3.1 that we use as a Heavy Forwarder that sends data to Splunk Cloud indexers using the UF credentials downloaded from the Splunk Cloud instance. After upgrading to 9.4.0, we started getting TCPOutAutoLB-0 error messages in the HF.

We tried installing a fresh 9.4.0 and 9.4.1 and just installing the UF certificate and we still get the error. Installing a fresh 9.3.1 with the same certificate does not have the error.

Has any one experienced the same problem? How were you able to fix it?

Regards,

Edward

Re: TCPOutAutoLB-0 after installing UF credentials from Splunk cloud

livehybrid — Thu, 10 Apr 2025 14:06:32 GMT

Hi @ejose

Please could you share the errors that you are receiving.

Can you also confirm the certificate has not expired? The reason I ask this specifically is that a Splunk forwarder will remain connected to another Splunk server even after an SSL cert has expired if it cannot create a new connection. In other words, its possible the certificate had previously expired but you only experienced an issue once the existing connection was closed down and you upgraded.

openssl x509 -in <PathToYourCert> -noout -dates

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: TCPOutAutoLB-0 after installing UF credentials from Splunk cloud

ejose — Fri, 11 Apr 2025 09:20:21 GMT

Hi,

I can confirm that the certificate is valid. We have use the same certificate on Splunk ver 9.3 and we don't get the TCPOutAutoLB-0 error. It only happens on ver 9.4.x

Re: TCPOutAutoLB-0 after installing UF credentials from Splunk cloud

kiran_panchavat — Sun, 13 Apr 2025 12:43:45 GMT

@ejose

Check this

https://community.splunk.com/t5/Getting-Data-In/How-to-fix-Heavy-Forwarder-to-Splunk-Cloud-logs-forward-error/td-p/645998

https://community.splunk.com/t5/Getting-Data-In/How-to-fix-TCPOutAutoLB-0-error/m-p/613119

Re: TCPOutAutoLB-0 after installing UF credentials from Splunk cloud

PickleRick — Sun, 13 Apr 2025 18:13:11 GMT

The first thing to check is the splunkd.log on the problematic (sending) machine. It should tell you if the connection is established at all or if it's being actively rejected or anythin else.

Re: TCPOutAutoLB-0 after installing UF credentials from Splunk cloud

ejose — Mon, 14 Apr 2025 09:59:13 GMT

Hi,

The problem seems to be the self signed certificate that was issued by Splunk from the cloud instance. It is not compatible with ver 9.4.

I was wondering if it was just me who is experiencing the issue or if some one else is experiencing it.

But for now we are sticking with ver 9.3.1 in our HF until a fix is released by Splunk.