topic Re: 104, Connection Reset by Peer error in Splunk Dev

104, Connection Reset by Peer error

loginsoft — Fri, 12 Jun 2020 07:04:44 GMT

We created a Splunk Add-on for one of our customers. We are able to call the Rest API and index the data in our environment. But when our client installed the Add-on he gets the below error message.

Error, connection aborted , 104, Connection Reset by Peer error. Below is the screenshot of the log.

We deployed the same AWS and GCP and it is working fine except in client environment.

We did a curl to the URL from the client server and it is working fine. Also the same URL is used in Splunk by our client in other Apps.

Can someone kindly help us here. We burned our all our debugging options.

Re: 104, Connection Reset by Peer error

livehybrid — Fri, 12 Jun 2020 07:16:55 GMT

Does the customer have an outbound firewall/security group that could be blocking the connection, or a transparent proxy that is filtering/blocking the traffic?

If you're using SplunkCloud and connecting to a port other than 443 then you might need to request that it be opened up by CloudOps via a support ticket.

Re: 104, Connection Reset by Peer error

loginsoft — Fri, 12 Jun 2020 07:25:42 GMT

Thanks @livehybrid for the reply.

Our customer is using on-prem instance. Also we queried the URL using wget command in splunk. It is working with wget. So now, will it be still issue with Firewall/Security Group/Filtering?

Re: 104, Connection Reset by Peer error

livehybrid — Fri, 12 Jun 2020 08:12:07 GMT

In that case its unlikely to be firewall related!

The other thing I was wondering is could it be connecting on the wrong protocol? e.g. can you confirm that you're connecting with HTTPS if the endpoint is HTTPS?

The other thing to check for is any proxies in the way that you might not go through when testing in the CLI - its worth checking in server.conf for a [proxyConfig] stanza, and in /opt/splunk/etc/splunk-launch.conf for any environment variable setting of proxies.

Re: 104, Connection Reset by Peer error

loginsoft — Fri, 12 Jun 2020 08:18:09 GMT

@livehybrid yes it is Https to Https call. Will check the config stanza and get back to you.