Getting Data In

HF can't reach splunk cloud

wxlcba
Loves-to-Learn

I've created the HF, and set up the ip allow list. From the Azure Connection troubleshoot, the testing is successful, NSG has createa and allow all connection to internet, then Windows firewall is disabled in the VM.

but I still get this error.

06-16-2024 22:59:24.253 +0000 WARN AutoLoadBalancedConnectionStrategy [8760 TcpOutEloop] - Cooked connection to ip=1.2.3.4:9997 timed out
06-16-2024 22:59:24.563 +0000 ERROR TcpOutputFd [8760 TcpOutEloop] - Read error. An existing connection was forcibly closed by the remote host.
06-16-2024 22:59:24.876 +0000 ERROR TcpOutputFd [8760 TcpOutEloop] - Read error. An existing connection was forcibly closed by the remote host.

 

running the comand netstat -anob to check the connections it will be stuck in the SYN_SENT status. but the messages said HF has been blocked for blocked_seconds=10

any ideas for fixing this issues?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @wxlcba ,

in addition to the checks hinted by @deepakc ,

did you downloaded and installed on your HFs the forwarder app from SplunkCloud? it contains the configuration for the connection.

Ciao.

Giuseppe

0 Karma

deepakc
Builder

It could be several things blocking you.

TcpOutputFd (this is normally a networking or config setting) 

You have set the whitelist and disabled the FW.

Other things to check:

  1. Check your network allows for the HF to route outbound to Splunk cloud
  2. Deploy the Splunk Credentials Package to the HF - https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/ConfigSCUFCredentials
  3. Check you can connect – try this command: 

 

 

 openssl s_client -connect inputs1.MY_STACK_NAME>.splunkcloud.com:9997​

 

 

 Further than that more troubleshooting is required. But it’s usually a networking that’s blocking.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...