https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-quot-TcpOutputFd-Connection-to-xxx/m-p/164127#M33259 <P>Thanks to everyone. I found the tcp port was not setup in the inputs.conf file. Added the tcp entry and it is working.</P> Thu, 23 Apr 2015 15:55:13 GMT pb0543 2015-04-23T15:55:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-quot-TcpOutputFd-Connection-to-xxx/m-p/164124#M33256 <P>I am getting a TcpOutputFd on the forwarder. Connection to xxx host failed. </P> <PRE><CODE>4-22-2015 16:17:34.736 -0400 WARN TcpOutputFd - Connect to :9997 failed. Connection refused 04-22-2015 16:17:34.745 -0400 ERROR TcpOutputFd - Connection to host=xxxxxx:9997 failed 04-22-2015 16:17:34.747 -0400 INFO TcpOutputProc - Detected idx=hostname:9997 shutting down 04-22-2015 16:17:34.747 -0400 INFO TcpOutputProc - Will close stream to current indexer xxxxxx </CODE></PRE> <P>I removed the host ip and replaced with xxx. Where should I investigate this issue?</P> Thu, 23 Apr 2015 14:15:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-quot-TcpOutputFd-Connection-to-xxx/m-p/164124#M33256 pb0543 2015-04-23T14:15:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-quot-TcpOutputFd-Connection-to-xxx/m-p/164125#M33257 <P>Hi pb0543,</P> <P>usually a message <CODE>connection refused</CODE> means that the remote server is not listening on the requested port. So check if you enabled receiving on your indexer <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Enableareceiver">http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Enableareceiver</A> and you're able to connect from the forwarder to the receiving port of the indexer (network routes, firewall and so on).</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Thu, 23 Apr 2015 14:19:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-quot-TcpOutputFd-Connection-to-xxx/m-p/164125#M33257 MuS 2015-04-23T14:19:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-quot-TcpOutputFd-Connection-to-xxx/m-p/164126#M33258 <P>Firstly, on Forwarder check to which instances it is sending the data to using<BR /> 1. /opt/splunk/bin/splunk btool outputs lists --debug<BR /> once u get the output list(IP's)<BR /> 2. Ping the IP's/IDX to check the connectivity</P> <P>Go to the respective IP's/IDX and check the instance status<BR /> 1. Server is up and running<BR /> 2. Look for listening ports(netstat -an)<BR /> 3. Check Splunk status and also the splunkd.logs</P> Thu, 23 Apr 2015 15:51:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-quot-TcpOutputFd-Connection-to-xxx/m-p/164126#M33258 neelamssantosh 2015-04-23T15:51:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-quot-TcpOutputFd-Connection-to-xxx/m-p/164127#M33259 <P>Thanks to everyone. I found the tcp port was not setup in the inputs.conf file. Added the tcp entry and it is working.</P> Thu, 23 Apr 2015 15:55:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-error-quot-TcpOutputFd-Connection-to-xxx/m-p/164127#M33259 pb0543 2015-04-23T15:55:13Z