Below is the error I am receiving on my splunkd.log on the Windows Splunk UF. The deployment server functionality is working correctly and able to send apps to the endpoint, just the data from the UF to the indexer is not working.
When I do a netstat -ano from the Windows host with the UF, there is a connection that is established (as well as the Splunk Indexer side).
07-04-2021 11:28:56.555 -0400 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
I have made sure that there is a path from the host to Splunk on the FW and there is no inspection that occurs.
I have a Splunk Index cluster with 3 indexers and a Cluster Master that is also has indexer discovery configured. I thought that there might be something wrong with the clustered setup, but i created a AIO Splunk instance just to test and still get the same message.
The deployment server feature is functioning just fine. I am able to push out apps the UF.
On the server side I get the following error messages on my indexer:
07-04-2021 11:28:55.535 -0400 ERROR TcpInputProc - Error encountered for connection from src=xxx.xxx.xxx.9:37765. Read Timeout Timed out after 600 seconds.
Thanks in advance and looking forward to any help.
