Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How do I resolve universal forwarder issue with TC...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello! Been using the universal forwarder for years connecting to a heavy forwarder currently forwarding to splunk cloud. Installing it on a new AWS host, running into the below errors when data inputs change. I've confirmed that the forwarder is reachable out from the host using telnet.
Any Ideas?
05-08-2023 10:35:09.570 -0400 INFO AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Removing quarantine from idx=10.9.101.133:9997 connid=2
05-08-2023 10:35:09.570 -0400 INFO AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Removing quarantine from idx=10.9.101.133:9997 connid=3
05-08-2023 10:35:09.601 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.648 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.679 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.726 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.773 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.773 -0400 WARN AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Applying quarantine to ip=10.9.101.133 port=9997 connid=3 _numberOfFailures=2
05-08-2023 10:35:09.804 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
05-08-2023 10:35:09.804 -0400 WARN AutoLoadBalancedConnectionStrategy [668 TcpOutEloop] - Applying quarantine to ip=10.9.101.133 port=9997 connid=2 _numberOfFailures=2
05-08-2023 10:35:09.851 -0400 ERROR TcpOutputFd [668 TcpOutEloop] - Read error. An established connection was aborted by the software in your host machine.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Resolved - Outbound traffic was fine from the AWS host, but inbound traffic to our DC wasn't showing the traffic reaching the heavy forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Resolved - Outbound traffic was fine from the AWS host, but inbound traffic to our DC wasn't showing the traffic reaching the heavy forwarder.
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...
Accelerating Observability as Code with the Splunk AI Assistant
