topic forwarder in Getting Data In

forwarder

SN1 — Thu, 06 Feb 2025 15:58:56 GMT

hello we are unable to receive logs from forwarders from 29 january. i checked splund.log and found this error
ERROR TcpOutputFd [110883 TcpOutEloop] - Connection to host=<ip>:port failed

what should I do?

Re: forwarder

livehybrid — Thu, 06 Feb 2025 16:04:28 GMT

The error you're seeing suggests a network connectivity issue between your forwarder and the receiving Splunk instance (likely an Indexer or Heavy Forwarder).

Here are some steps to troubleshoot:

Verify network connectivity: -

Can you connect to the destination host from the forwarder (Try using netcat with something like `nc -vz -w1 <destinationIP> <destinationPort>`
Is the specified port open and accessible on the destination server (Is Splunk listening?)
Are any other hosts able to connect and send data?
Check firewall rules: - Ensure no firewall is blocking the connection on either end.
Verify Splunk configurations: - On the forwarder, check outputs.conf for correct destination settings. - On the receiving end, verify inputs.conf for proper port configurations.
Restart Splunk services: - Sometimes a restart can resolve connectivity issues, try restarting the forwarder, if no progress then try restart Splunk on the receiver to confirm it is working correctly.
Check for any recent network changes - Were there any infrastructure modifications around January 29th?

Please let me know how you get on and consider upvoting/karma this answer if it has helped.
Regards

Will

Re: forwarder

gcusello — Thu, 06 Feb 2025 16:06:03 GMT

Hi @SN1 ,

probably that day someone closed the firewall port between Forwarder and Indexer.

The port should be 9997.

if this is the port, you can try using telnet from the Forwarder:

telnet <host_ip> <port>

Ciao.

Giuseppe

Re: forwarder

SN1 — Fri, 07 Feb 2025 04:27:52 GMT

hello after this command on deployment server it is showing this error

telnet: Unable to connect to remote host: Connection refused

Re: forwarder

SanjayReddy — Fri, 07 Feb 2025 06:22:45 GMT

Hi @SN1

telent command need to run on forwader as mentioned by @gcusello and also hope you followed stpes menioned by @livehybrid