topic ERROR TcpOutputFd [ TcpOutEloop] - Expecting to be in eWaitCapabilityResponse, found itself in SendCapability in Deployment Architecture

ERROR TcpOutputFd [ TcpOutEloop] - Expecting to be in eWaitCapabilityResponse, found itself in SendCapability

lar06 — Wed, 12 Mar 2025 07:03:09 GMT

Hello

Using Splunk 9.3.2

What does this error mean ?

ERROR TcpOutputFd [ TcpOutEloop] - Expecting to be in eWaitCapabilityResponse, found itself in SendCapability

Thanks

Re: ERROR TcpOutputFd [ TcpOutEloop] - Expecting to be in eWaitCapabilityResponse, found itself in SendCapability

livehybrid — Wed, 12 Mar 2025 07:21:24 GMT

Hi @lar06

Please can you confirm that you are using 9.3.2 on both the source and destination Splunk instance and that it is not being sent via any non-supported Splunk versions or external systems?

Have you made any recent changes to the architecture?

Are either the client/source or destination server running hot (ie high CPU?)

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: ERROR TcpOutputFd [ TcpOutEloop] - Expecting to be in eWaitCapabilityResponse, found itself in SendCapability

lar06 — Wed, 12 Mar 2025 10:17:33 GMT

Hi Will

Yes, both are 9.3.2 but we have Cribl in between. So I assume the message is due to Cribl.

Is there any doc about those terms ?

Thanks

Lionel

Re: ERROR TcpOutputFd [ TcpOutEloop] - Expecting to be in eWaitCapabilityResponse, found itself in SendCapability

livehybrid — Wed, 12 Mar 2025 10:26:03 GMT

Hi @lar06

No, there isnt anything that I have found in relation to this error, as this is a relatively low-level error which I believe you wouldnt encounter unless there were issues with the Splunk2Splunk (S2S) communication.

I think you will need to consult Splunk and/or Cribl Support in order to get to the bottom of this. Ironically the only times I have heard of this issue referenced before is when using Cribl (hence my question about sending via non-supported versions or external systems) so it might be worth speaking to Cribl support first as they may have resolved this for other people.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will