topic Re: connection errors when I restart splunk in Getting Data In

connection errors when I restart splunk

RuthBishop — Thu, 08 May 2014 16:17:08 GMT

Hi I cannot get the universal forwarder to move to active mode.

I get the following error in splunkd logs. Can you help me sort this out.

05-08-2014 11:49:28.432 -C- Connection to host=10.1.1.xxx :9997 failed
05-08-2014 11:49:58.257 -0400 WARN TcpOutputFd - Connect to 10.1.1.xxx:9997 fa iled. Connection refused
05-08-2014 11:49:58.257 -0400 ERROR TcpOutputFd - Connection to host=10.1.1.146 :9997 failed
05-08-2014 11:50:28.268 -0400 WARN TcpOutputFd - Connect to 10.1.1.xxx:9997 fa iled. Connection refused
05-08-2014 11:50:28.268 -0400 ERROR TcpOutputFd - Connection to host=10.1.1.xxx :9997 failed
05-08-2014 11:50:58.261 -0400 WARN TcpOutputFd - Connect to 10.1.1.xxx:9997 fa iled. Connection refused
05-08-2014 11:50:58.261 -0400 ERROR TcpOutputFd - Connection to host=10.1.1.xxx :9997 failed
[root@d1asepric577 bin]# tail 200 /opt/splunkforwarder/var/log/splunk/splunkd.log

Re: connection errors when I restart splunk

martin_mueller — Thu, 08 May 2014 17:21:56 GMT

Sounds as if the forwarder is getting a connection refused on port 9997 of 10.1.1.146 - make sure you have turned on receiving on that Splunk instance, and that the network path including firewalls is open.

Re: connection errors when I restart splunk

RuthBishop — Thu, 08 May 2014 17:42:30 GMT

I'm able to telent to the indexer on that port.

[root@d1asepric578 bin]# telnet d1asepric567 9997
Trying 10.1.1.136...
Connected to d1asepric567.
Escape character is '^]'.

But I agree something is blocking the connection and it seems to be on the forwarer side. I not quite sure were to look.

Re: connection errors when I restart splunk

martin_mueller — Thu, 08 May 2014 17:48:42 GMT

That's 10.1.1.136, the forwarder seems to complain about 10.1.1.146.