topic Re: Sending data from onprem splunk to cloud - SSL error in Splunk Cloud Platform

Sending data from onprem splunk to cloud - SSL error

lakshman239 — Wed, 14 May 2025 17:52:26 GMT

Hi,

I have installed splunk 9.4.2 on-prem and downloaded and installed the 'splunkuf' app from splunkcloud universal forwarder package. Upon restarting the splunk instance, it throws following errors. I just want to ensure the internal logs reach cloud before i configure the server with custom apps/add-ons.

05-14-2025 13:05:23.918 +0000 ERROR TcpOutputFd [2377196 TcpOutEloop] - Connection to host=18.xx:9997 failed. sock_error = 104. SSL Error = No error

I have checked connectivity from on-prem instance to inputs1.*.splunkcloud.com:9997 using curl/telnet and openssl and firewall team confirmed the ports are open.

Any thoughts on what I could be missing or suggestions to troubleshoot?

thanks

laks

Re: Sending data from onprem splunk to cloud - SSL error

livehybrid — Thu, 15 May 2025 00:12:04 GMT

Hi @lakshman239

I would ask the firewall to check/show that the traffic is not being blocked. I spent a lot of time with a customer recently who told me we had a direct connection to Splunk Cloud when infact it went via some PaloAlto firewalls which were occasionally blocking, when it blocked it gave that exact error.

If you're able to do the usual netcat/openssl tests that it shows your connectivity should be okay so hard to pinpoint.

Check out https://community.splunk.com/t5/Deployment-Architecture/Connection-problems-with-Universal-Forwarder-for-Linux-ARM-and/m-p/232759 which has some more detail too about.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Sending data from onprem splunk to cloud - SSL error

lakshman239 — Fri, 16 May 2025 10:35:50 GMT

Thanks @livehybrid The issue was at the firewall side. It was dropping packets, so the policies/rules had to applied again.

Also added some useful link which i came across.

https://community.splunk.com/t5/Security/ERROR-TcpOutputFd-Connection-to-host-c-9997-failed-sock-error/m-p/487895

https://splunk.my.site.com/customer/s/article/Splunk-Universal-Forwarder-is-not-sending-events-to-Splunk-Cloud