Getting Data In

Read error. Either the application has not called WSAStartup, or WSAStartup failed.

splunker12er
Motivator

I am getting the below error in splunkd.log

04-16-2014 05:20:42.782 +0000 ERROR TcpOutputFd - Read error. Either the application has not called WSAStartup, or WSAStartup failed.
04-16-2014 05:20:42.782 +0000 INFO  TcpOutputProc - Connection to 10.200.200.205:9997 closed. Read error. Either the application has not called WSAStartup, or WSAStartup failed.

My configs:

  • inputs.conf

Location : C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local

[WinEventLog:Application]
disabled = 0
index = nttj_application_logs
  • outputs.conf

Location : C:\Program Files\SplunkUniversalForwarder\etc\system\local

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.200.200.205:9997

[tcpout-server://10.200.200.205:9997]

Please let me know what does this error mean ?

0 Karma

ludowillemans
Explorer

I am having the same problem.

ERROR TcpOutputFd - Read error. Either the application has not called WSAStartup, or WSAStartup failed.

Just changed the system\local\inputs.conf, restarted splunk and now I get his error.
Even when I remove my change I am still getting this error.

0 Karma

lmyrefelt
Builder

Not that it shouldnt be in the way of having it working, but you dont need to specify booth a tcp-group and a tcpout-server in your outputs.conf .
One or the other should be OK.

Have you tried to re-install the agent ?
I have seen this message on a forwarder just the other day .. however in my case it was enough to just restart the agent (if i am not remembering wrong .. since i did not get ony more troubles with the forwarder after that i did not take any ation on the message) .

0 Karma

lmyrefelt
Builder

And dubbelcheck any configurations that might interfere with each other.

0 Karma

jofe
Explorer

Have the same problem here aswell.

Exact same error message on a Win 2008 server - (6.13 universalforwarder). It connect to the indexer, but does not forward any data.

0 Karma

splunker12er
Motivator

nope. STill i face the same error. Can someone help in this?

0 Karma

splunkranger
Path Finder

Did you find an answer for this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...