Cooked connection to ip timed out

joliver — Fri, 20 Feb 2015 15:42:58 GMT

We already have universal forwarders set up on multiple servers that are working fine. I have installed a new universal forwarder on a different server, but cannot make a connection to the indexer. I am using the same configurations as the forwarders that are working, but am receiving the error below. I have already tried adding [splunktcp://9997] and Connection_host = none to inputs.conf, then restarting Splunk, but this had no effect. Anyone know what causes this error? Thanks for any advice you could provide. This is driving me nuts!

Here's the error:
-0500 WARN TcpOutputProc - Cooked connection to ip=xx.x.xxx.xxx:4444 timed out

Here's my inputs.conf:
[default]
host = my server name

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

Here's my outputs.conf:
[tcpout]
defaultGroup = xx.x.xxx.xxx_4444
disabled = false

[tcpout:xx.x.xxx.xxx_4444]
server = xx.x.xxx.xxx:4444

[tcpout-server://xx.x.xxx.xxx:4444]

Re: Cooked connection to ip timed out

masonmorales — Thu, 05 Mar 2015 19:48:22 GMT

You can also identify firewall issues by using the telnet command on your forwarder...

telnet <indexer_ip> <indexer port>

If you don't receive a "connected to ......" message, it's usually a firewall issue.

Re: Cooked connection to ip timed out

joliver — Thu, 05 Mar 2015 19:48:23 GMT

This ended up being a firewall issue.

topic Re: Cooked connection to ip timed out in Getting Data In

Cooked connection to ip timed out

Re: Cooked connection to ip timed out

Re: Cooked connection to ip timed out