How to troubleshoot why Windows universal forwarder connection to Sandbox errors out no matter what method used?

[DelProfundo]

Lots of posts on this, all are wrong. Both methods (manual modification of outputs.conf files and installing the app from the cloud management interface) fail with the same old errors that everyone else complains about.

01-27-2015 19:52:39.782 +1000 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
01-27-2015 19:52:40.942 +1000 INFO  TcpOutputProc - Connected to idx=54.84.49.180:9997 using ACK.
01-27-2015 19:52:47.265 +1000 INFO  TailingProcessor - Could not send data to output queue (parsingQueue), retrying...

I have linux and OSX hosts on the same network and others are hitting the sandbox correctly.

I can TELNET to the input- :9997 address.

Please help. I am really over this. I have used every link mentioned in the other posts and none work. Well, except for the command line testing on the server side, but given I am using the cloud sandbox, I do not have CLI access.

[DelProfundo · Accepted solution]

The solution was to not put the address of the splunk server in the setup wizard of the forwarder but to run the app.