HF can't reach splunk cloud

[wxlcba]

I've created the HF, and set up the ip allow list. From the Azure Connection troubleshoot, the testing is successful, NSG has createa and allow all connection to internet, then Windows firewall is disabled in the VM.

but I still get this error.

06-16-2024 22:59:24.253 +0000 WARN AutoLoadBalancedConnectionStrategy [8760 TcpOutEloop] - Cooked connection to ip=1.2.3.4:9997 timed out
06-16-2024 22:59:24.563 +0000 ERROR TcpOutputFd [8760 TcpOutEloop] - Read error. An existing connection was forcibly closed by the remote host.
06-16-2024 22:59:24.876 +0000 ERROR TcpOutputFd [8760 TcpOutEloop] - Read error. An existing connection was forcibly closed by the remote host.

running the comand netstat -anob to check the connections it will be stuck in the SYN_SENT status. but the messages said HF has been blocked for blocked_seconds=10

any ideas for fixing this issues?

[gcusello]

Hi @wxlcba ,

in addition to the checks hinted by @deepakc ,

did you downloaded and installed on your HFs the forwarder app from SplunkCloud? it contains the configuration for the connection.

Ciao.

Giuseppe

[deepakc]

It could be several things blocking you.

TcpOutputFd (this is normally a networking or config setting) 

You have set the whitelist and disabled the FW.

Other things to check:

1. Check your network allows for the HF to route outbound to Splunk cloud
2. Deploy the Splunk Credentials Package to the HF - https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/ConfigSCUFCredentials
3. Check you can connect – try this command: 
   
   

 openssl s_client -connect inputs1.MY_STACK_NAME>.splunkcloud.com:9997​

 Further than that more troubleshooting is required. But it’s usually a networking that’s blocking.