Cooked connection time out with splunk heavy forwarder

[moohkhol]

Hi Guys,
I know, many people have asked this question and i have gone through many post but still no clue to solve my problem.

I have set-up heavy forwarder ,
Path: /splunk/etc/system/default

inputs.conf

[monitor:///usr/local/.../test.log]
index = main
sourcetype = %sourcetype%

[splunktcp://9997]
connection_host = ip

outputs.conf

[tcpout]
defaultGroup = splunkindexer_9997

indexAndForward = 1

[tcpout:splunkindexer_9997]

autoLB = true

server = serverip:9997

[tcpout-server://serverip:9997]

Our indexer has installed on serverip and from GUI, i have added TCP input type where i have given index as main and sourcetype as sourcetype

I have restart many time and still i am getting error cooked connection and connection time out.

One interesting thing, at indexer side, if i am searching sourcetype=sourcetype I am getting cooked events from forwarder machine but actual log data are not getting forwarded.

Please suggest.

[moohkhol]

Thanks a lot Ayan, it's works for me, I have change splunktcp at indexer side.

[Ayn]

No problem. Please mark my answer as accepted.

[Ayn · Accepted solution]

From the looks of it you've configured a raw TCP input on port 9997 on the indexer rather than a receiving port. It needs to be splunktcp, not tcp in inputs.conf. Could you please paste relevant inputs.conf on the indexer?