Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Read error. Either the application has not cal...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Read error. Either the application has not called WSAStartup, or WSAStartup failed.
I am getting the below error in splunkd.log
04-16-2014 05:20:42.782 +0000 ERROR TcpOutputFd - Read error. Either the application has not called WSAStartup, or WSAStartup failed.
04-16-2014 05:20:42.782 +0000 INFO TcpOutputProc - Connection to 10.200.200.205:9997 closed. Read error. Either the application has not called WSAStartup, or WSAStartup failed.
My configs:
- inputs.conf
Location : C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local
[WinEventLog:Application]
disabled = 0
index = nttj_application_logs
- outputs.conf
Location : C:\Program Files\SplunkUniversalForwarder\etc\system\local
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 10.200.200.205:9997
[tcpout-server://10.200.200.205:9997]
Please let me know what does this error mean ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am having the same problem.
ERROR TcpOutputFd - Read error. Either the application has not called WSAStartup, or WSAStartup failed.
Just changed the system\local\inputs.conf, restarted splunk and now I get his error.
Even when I remove my change I am still getting this error.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not that it shouldnt be in the way of having it working, but you dont need to specify booth a tcp-group and a tcpout-server in your outputs.conf .
One or the other should be OK.
Have you tried to re-install the agent ?
I have seen this message on a forwarder just the other day .. however in my case it was enough to just restart the agent (if i am not remembering wrong .. since i did not get ony more troubles with the forwarder after that i did not take any ation on the message) .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
And dubbelcheck any configurations that might interfere with each other.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have the same problem here aswell.
Exact same error message on a Win 2008 server - (6.13 universalforwarder). It connect to the indexer, but does not forward any data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nope. STill i face the same error. Can someone help in this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you find an answer for this?
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
