topic Re: HF can't reach splunk cloud in Getting Data In

HF can't reach splunk cloud

wxlcba — Sun, 16 Jun 2024 23:45:10 GMT

I've created the HF, and set up the ip allow list. From the Azure Connection troubleshoot, the testing is successful, NSG has createa and allow all connection to internet, then Windows firewall is disabled in the VM.

but I still get this error.

06-16-2024 22:59:24.253 +0000 WARN AutoLoadBalancedConnectionStrategy [8760 TcpOutEloop] - Cooked connection to ip=1.2.3.4:9997 timed out
06-16-2024 22:59:24.563 +0000 ERROR TcpOutputFd [8760 TcpOutEloop] - Read error. An existing connection was forcibly closed by the remote host.
06-16-2024 22:59:24.876 +0000 ERROR TcpOutputFd [8760 TcpOutEloop] - Read error. An existing connection was forcibly closed by the remote host.

running the comand netstat -anob to check the connections it will be stuck in the SYN_SENT status. but the messages said HF has been blocked for blocked_seconds=10

any ideas for fixing this issues?

Re: HF can't reach splunk cloud

deepakc — Mon, 17 Jun 2024 08:00:38 GMT

It could be several things blocking you.

TcpOutputFd (this is normally a networking or config setting)

You have set the whitelist and disabled the FW.

Other things to check:

Check your network allows for the HF to route outbound to Splunk cloud
Deploy the Splunk Credentials Package to the HF - https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/ConfigSCUFCredentials
Check you can connect – try this command:

openssl s_client -connect inputs1.MY_STACK_NAME>.splunkcloud.com:9997

Further than that more troubleshooting is required. But it’s usually a networking that’s blocking.

Re: HF can't reach splunk cloud

gcusello — Mon, 17 Jun 2024 08:05:53 GMT

Hi @wxlcba ,

in addition to the checks hinted by @deepakc ,

did you downloaded and installed on your HFs the forwarder app from SplunkCloud? it contains the configuration for the connection.

Ciao.

Giuseppe