https://community.splunk.com/t5/Deployment-Architecture/Splunk-Forwarder-Connection-Issue-with-quot-Error-in-SSL-read/m-p/419412#M14944 <P>Not really, the issue persists. </P> Wed, 28 Aug 2019 06:19:42 GMT caglabaylan 2019-08-28T06:19:42Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-Forwarder-Connection-Issue-with-quot-Error-in-SSL-read/m-p/419410#M14942 <P>Splunk Forwarder 7.2.1 is installed on Windows 2016 instance cannot send logs/data to the indexer with version 7.1.3.<BR /> We have other Windows 2008 instances with same configuration, which can succesfully connect to the indexer. <BR /> We think that there is a bug with Splunk Forwarder on Windows 2016 instances.<BR /> (Firewall rules are checked and enabled.)<BR /> Here are the errors:</P> <PRE><CODE>04-16-2019 13:46:14.222 +0000 INFO TcpOutputProc - Connection to x.x.x.x:9997 closed. sock_error = 10054. SSL Error = error:00000000:lib(0):func(0):reason(0) 04-16-2019 13:46:14.222 +0000 WARN TcpOutputProc - Possible duplication of events with channel=source::Perfmon:Process|host::XXXX|Perfmon:Process|, streamId=15911254072694239019, offset=8243074 on host=x.x.x.x:9997 04-16-2019 13:46:14.268 +0000 INFO TcpOutputProc - Connection to x.x.x.x:9997 closed. default Error in SSL_read = 10054, SSL Error = error:00000000:lib(0):func(0):reason(0) 04-16-2019 13:46:14.268 +0000 WARN TcpOutputProc - Applying quarantine to ip=x.x.x.x port=9997 _numberOfFailures=2 04-16-2019 13:46:14.268 +0000 WARN TcpOutputProc - Possible duplication of events with channel=source::Perfmon:Process|host::XXXX|Perfmon:Process|, streamId=15911254072694239019, offset=11879036 on host=x.x.x.x:9997 </CODE></PRE> Thu, 18 Apr 2019 11:53:40 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-Forwarder-Connection-Issue-with-quot-Error-in-SSL-read/m-p/419410#M14942 caglabaylan 2019-04-18T11:53:40Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-Forwarder-Connection-Issue-with-quot-Error-in-SSL-read/m-p/419411#M14943 <P>Did you ever figure out a solution for this one?</P> Tue, 27 Aug 2019 20:24:05 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-Forwarder-Connection-Issue-with-quot-Error-in-SSL-read/m-p/419411#M14943 imarks005 2019-08-27T20:24:05Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-Forwarder-Connection-Issue-with-quot-Error-in-SSL-read/m-p/419412#M14944 <P>Not really, the issue persists. </P> Wed, 28 Aug 2019 06:19:42 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-Forwarder-Connection-Issue-with-quot-Error-in-SSL-read/m-p/419412#M14944 caglabaylan 2019-08-28T06:19:42Z