topic Re: TCP Cooked connection ? in Getting Data In

TCP Cooked connection ?

lain179 — Tue, 13 Nov 2012 16:46:02 GMT

Why is this happening?

11-13-2012 16:40:04.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:12.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:33.779 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:34.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:34.778 +0000 WARN  TcpOutputProc - Applying quarantine to ip=IPADDRESS  port=PORT#_numberOfFailures=2
11-13-2012 16:40:54.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out

Re: TCP Cooked connection ?

paul_1994 — Wed, 09 Jan 2013 22:54:32 GMT

Or can someone give an explanation of what it means?

Re: TCP Cooked connection ?

hagjos43 — Tue, 18 Jun 2013 17:44:20 GMT

We currently have this issue too. I'm running a lot of scenarios and with no luck thus far.

Re: TCP Cooked connection ?

nathanjenkins — Tue, 12 Mar 2019 17:06:51 GMT

Cooked connection means that somewhere along the network your SSL connection is being blocked.

Could be the indexer is not configured with the right certificate to accept encrypted connections
a firewall is blocking the connection
also remember always restart splunk after any configuration changes in order for them to take effect

To identify the cause of the problem visit:
http://www.visicoretech.com/splunk/splunk-troubleshooting-forwarder/

Re: TCP Cooked connection ?

richgalloway — Tue, 12 Mar 2019 17:32:15 GMT

"cooked" refers to data that has already been processed by an indexer or heavy forwarder.