topic Re: Why am I receiving warning in Splunk log for timedout? in Getting Data In

Why am I receiving warning in Splunk log for timedout?

vikrghos — Thu, 30 Mar 2023 14:05:44 GMT

Getting warning for all our forwarders - is there any problem

03-30-2023 05:00:23.265 +0530 INFO AutoLoadBalancedConnectionStrategy [7124 TcpOutEloop] - Connected to idx=10.22.91.231:9997, pset=1, reuse=0. using ACK.
03-30-2023 05:00:25.234 +0530 INFO AutoLoadBalancedConnectionStrategy [7124 TcpOutEloop] - After randomization, current is first in the list. Swapping with last item
03-30-2023 05:00:25.531 +0530 WARN AutoLoadBalancedConnectionStrategy [6916 TcpOutEloop] - Cooked connection to ip=10.22.91.231:9997 timed out
03-30-2023 05:00:25.531 +0530 INFO AutoLoadBalancedConnectionStrategy [7148 TcpOutEloop] - Closing stream for idx=3.81.182.58:9997
03-30-2023 05:00:25.531 +0530 INFO AutoLoadBalancedConnectionStrategy [7148 TcpOutEloop] - Connected to idx=10.22.91.231:9997, pset=5, reuse=0. using ACK.
03-30-2023 05:00:26.109 +0530 WARN AutoLoadBalancedConnectionStrategy [6236 TcpOutEloop] - Cooked connection to ip=10.22.91.231:9997 timed out

Re: Why am I receiving warning in Splunk log for timedout?

vinoth_raj — Sun, 30 Apr 2023 08:09:47 GMT

A similar issue is discussed in the link below:

https://community.splunk.com/t5/Getting-Data-In/How-can-I-overcome-TCP-cooked-connection-timeout/m-p/628962

If it helps, give a karma.

Re: Why am I receiving warning in Splunk log for timedout?

PickleRick — Sun, 30 Apr 2023 08:18:48 GMT

Timeout means that one side performed some operation and waited for a result which didn't occur. In thes case it means that the forwarder tried to establish connection to a given ip:port but the receiver didn't respond in time to the connection request. It is typically an issue with your network configuration (routing, firewalling, filtering on the destination host).