Getting Data In

Cooked connection to ip timed out

joliver
New Member

We already have universal forwarders set up on multiple servers that are working fine. I have installed a new universal forwarder on a different server, but cannot make a connection to the indexer. I am using the same configurations as the forwarders that are working, but am receiving the error below. I have already tried adding [splunktcp://9997] and Connection_host = none to inputs.conf, then restarting Splunk, but this had no effect. Anyone know what causes this error? Thanks for any advice you could provide. This is driving me nuts!

Here's the error:
-0500 WARN TcpOutputProc - Cooked connection to ip=xx.x.xxx.xxx:4444 timed out

Here's my inputs.conf:
[default]
host = my server name

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

Here's my outputs.conf:
[tcpout]
defaultGroup = xx.x.xxx.xxx_4444
disabled = false

[tcpout:xx.x.xxx.xxx_4444]
server = xx.x.xxx.xxx:4444

[tcpout-server://xx.x.xxx.xxx:4444]

0 Karma
1 Solution

masonmorales
Influencer

You can also identify firewall issues by using the telnet command on your forwarder...

telnet <indexer_ip> <indexer port>

If you don't receive a "connected to ......" message, it's usually a firewall issue.

View solution in original post

masonmorales
Influencer

You can also identify firewall issues by using the telnet command on your forwarder...

telnet <indexer_ip> <indexer port>

If you don't receive a "connected to ......" message, it's usually a firewall issue.

joliver
New Member

This ended up being a firewall issue.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...