Getting Data In

How to troubleshoot why Windows universal forwarder connection to Sandbox errors out no matter what method used?

DelProfundo
Explorer

Lots of posts on this, all are wrong. Both methods (manual modification of outputs.conf files and installing the app from the cloud management interface) fail with the same old errors that everyone else complains about.

01-27-2015 19:52:39.782 +1000 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
01-27-2015 19:52:40.942 +1000 INFO  TcpOutputProc - Connected to idx=54.84.49.180:9997 using ACK.
01-27-2015 19:52:47.265 +1000 INFO  TailingProcessor - Could not send data to output queue (parsingQueue), retrying...

I have linux and OSX hosts on the same network and others are hitting the sandbox correctly.

I can TELNET to the input- :9997 address.

Please help. I am really over this. I have used every link mentioned in the other posts and none work. Well, except for the command line testing on the server side, but given I am using the cloud sandbox, I do not have CLI access.

0 Karma
1 Solution

DelProfundo
Explorer

The solution was to not put the address of the splunk server in the setup wizard of the forwarder but to run the app.

View solution in original post

DelProfundo
Explorer

The solution was to not put the address of the splunk server in the setup wizard of the forwarder but to run the app.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...