Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How do I resolve universal forwarder issue wit...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello! Been using the universal forwarder for years connecting to a heavy forwarder currently forwarding to splunk cloud. Installing it on a new AWS host, running into the below errors when data inputs change. I've confirmed that the forwarder is reachable out from the host using telnet.
Any Ideas?
05-08-2023 10:35:09.570 -0400 INFO AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Removing quarantine from idx=10.9.101.133:9997 connid=2
05-08-2023 10:35:09.570 -0400 INFO AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Removing quarantine from idx=10.9.101.133:9997 connid=3
05-08-2023 10:35:09.601 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.648 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.679 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.726 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.773 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.773 -0400 WARN AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Applying quarantine to ip=10.9.101.133 port=9997 connid=3 _numberOfFailures=2
05-08-2023 10:35:09.804 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.804 -0400 WARN AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Applying quarantine to ip=10.9.101.133 port=9997 connid=2 _numberOfFailures=2
05-08-2023 10:35:09.851 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Resolved - Outbound traffic was fine from the AWS host, but inbound traffic to our DC wasn't showing the traffic reaching the heavy forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Resolved - Outbound traffic was fine from the AWS host, but inbound traffic to our DC wasn't showing the traffic reaching the heavy forwarder.
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
