topic Re: 10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it. in Getting Data In

10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

russellrobertso — Sat, 26 Oct 2013 16:08:11 GMT

I'm struggling to get Exchange Universal Forwarders to connect to the central instance.

This is the error in the splunkd log;

10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

So trying a portqry on that port on that server and this is the response

Name resolved to 192.168.x.x

querying...

TCP port 9997 (unknown service): NOT LISTENING

Firewall on the central server is off and so not sure what the issue is here.

Checking the Splunk services on the central server show the splunkd service running on 8089 and the web service running on 8000.

Am I missing a service or should I be pointing to 8089?

This is a new central server install on Server 2012 R2, Splunk V6. Exchange is 2010 and installed SP2 just for Splunk.

Re: 10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

ShaneNewman — Sat, 26 Oct 2013 17:39:19 GMT

Log into your indexer. If you are using 6.0 then click settings in the upper right hand corner, then forwarding and receiving. Under receive data click on configure receiving. Then add new, type 9997 - save.

Re: 10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

ShaneNewman — Mon, 28 Oct 2013 23:57:09 GMT

Did this help or is that not the problem?

Re: 10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

russellrobertso — Wed, 30 Oct 2013 12:23:31 GMT

Hello

Excellent, this has fixed.

Thanks

Russell

Re: 10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

kcooper — Fri, 14 Mar 2014 17:05:13 GMT

how about if we are still using 5.0.6? How is this fixed?

Re: 10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made because the target machine actively refused it.

somesoni2 — Fri, 14 Mar 2014 17:13:12 GMT

Same steps.

Re: 10-26-2013 16:39:13.343 +0100 WARN TcpOutputFd - Connect to 192.168.x.x:9997 failed. No connection could be made be

jkamdar — Wed, 24 Apr 2024 19:24:32 GMT

Thanks, somehow I didn't see anywhere this step. My errors are gone, now waiting for data to show up on the indexer.