topic Re: TcpOutputFd [800 TcpOutEloop] - Connection to host=xx.xxx.xxx.xxx:9997 failed in Getting Data In

Why did logs stopped abruptly after installing UF on my windows?

thevikramyadav — Thu, 19 Jan 2023 18:12:18 GMT

Hi Guys, I have UF installed on my windows machine, abruptly last month logs got stopped. I check in splunkd log file and saw the error
TcpOutputFd [800 TcpOutEloop] - Connection to host=xx.xxx.xxx.xxx:9997 failed

Also after restarting, it resumes sending logs to Splunk for some days but again it will stop and gives the same error.

Not sure how to fix this issue and proceed.

Re: TcpOutputFd [800 TcpOutEloop] - Connection to host=xx.xxx.xxx.xxx:9997 failed

gcusello — Thu, 19 Jan 2023 07:32:04 GMT

Hi @thevikramyadav,

if your Splunk server continues to receive logs from other Universal Forwarders, the problem could be in the connection.

Check it using telnet:

telnet <ip_splunk_server> 9997

maybe something changed in the firewall rules.

Ciao.

Giuseppe

Re: Why did logs stopped abruptly after installing UF on my windows?

yazeedallabadi2 — Tue, 30 Sep 2025 08:54:02 GMT

Any updates on how to fix this issue.
We are facing a similar issue where hosts randomly stop reporting to the HF. Restarting the Splunk Universal Forwarder service fixes the issue for a while before the issue comes back again and the hosts stop reporting to Splunk HF again.

Re: Why did logs stopped abruptly after installing UF on my windows?

PickleRick — Tue, 30 Sep 2025 11:22:43 GMT

And are you sure that it's the Splunk's issue? From the symptoms it could as well be a lot of other issues - OS-level ones, network ones... Have you done _any_ troubleshooting or just assumed that it's Splunk's fault? I'm not saying it isn't but how did you come to that conclusion?

Re: Why did logs stopped abruptly after installing UF on my windows?

burwell — Sun, 26 Oct 2025 02:58:01 GMT

Hi @yazeedallabadi2 did you see this https://splunk.my.site.com/customer/s/article/HF-paused-data-flow-due-to-connection-timeout-but-didn-t-resume-data-transfer-after-the-connection-is-established

I see that it says it affects UF as well as HF