Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Read error. Either the application has not cal...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Read error. Either the application has not called WSAStartup, or WSAStartup failed.
I am getting the below error in splunkd.log
04-16-2014 05:20:42.782 +0000 ERROR TcpOutputFd - Read error. Either the application has not called WSAStartup, or WSAStartup failed.
04-16-2014 05:20:42.782 +0000 INFO TcpOutputProc - Connection to 10.200.200.205:9997 closed. Read error. Either the application has not called WSAStartup, or WSAStartup failed.
My configs:
- inputs.conf
Location : C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local
[WinEventLog:Application]
disabled = 0
index = nttj_application_logs
- outputs.conf
Location : C:\Program Files\SplunkUniversalForwarder\etc\system\local
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 10.200.200.205:9997
[tcpout-server://10.200.200.205:9997]
Please let me know what does this error mean ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am having the same problem.
ERROR TcpOutputFd - Read error. Either the application has not called WSAStartup, or WSAStartup failed.
Just changed the system\local\inputs.conf, restarted splunk and now I get his error.
Even when I remove my change I am still getting this error.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not that it shouldnt be in the way of having it working, but you dont need to specify booth a tcp-group and a tcpout-server in your outputs.conf .
One or the other should be OK.
Have you tried to re-install the agent ?
I have seen this message on a forwarder just the other day .. however in my case it was enough to just restart the agent (if i am not remembering wrong .. since i did not get ony more troubles with the forwarder after that i did not take any ation on the message) .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
And dubbelcheck any configurations that might interfere with each other.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have the same problem here aswell.
Exact same error message on a Win 2008 server - (6.13 universalforwarder). It connect to the indexer, but does not forward any data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nope. STill i face the same error. Can someone help in this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you find an answer for this?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Skip the Awkward Silence: Have a .conf-ersation at .conf26
Rethinking Zero Trust: From Product Purchases to Logical Control Evidence
