Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Read error. Either the application has not called ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Read error. Either the application has not called WSAStartup, or WSAStartup failed.
I am getting the below error in splunkd.log
04-16-2014 05:20:42.782 +0000 ERROR TcpOutputFd - Read error. Either the application has not called WSAStartup, or WSAStartup failed.
04-16-2014 05:20:42.782 +0000 INFO TcpOutputProc - Connection to 10.200.200.205:9997 closed. Read error. Either the application has not called WSAStartup, or WSAStartup failed.
My configs:
- inputs.conf
Location : C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local
[WinEventLog:Application]
disabled = 0
index = nttj_application_logs
- outputs.conf
Location : C:\Program Files\SplunkUniversalForwarder\etc\system\local
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 10.200.200.205:9997
[tcpout-server://10.200.200.205:9997]
Please let me know what does this error mean ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am having the same problem.
ERROR TcpOutputFd - Read error. Either the application has not called WSAStartup, or WSAStartup failed.
Just changed the system\local\inputs.conf, restarted splunk and now I get his error.
Even when I remove my change I am still getting this error.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not that it shouldnt be in the way of having it working, but you dont need to specify booth a tcp-group and a tcpout-server in your outputs.conf .
One or the other should be OK.
Have you tried to re-install the agent ?
I have seen this message on a forwarder just the other day .. however in my case it was enough to just restart the agent (if i am not remembering wrong .. since i did not get ony more troubles with the forwarder after that i did not take any ation on the message) .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
And dubbelcheck any configurations that might interfere with each other.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have the same problem here aswell.
Exact same error message on a Win 2008 server - (6.13 universalforwarder). It connect to the indexer, but does not forward any data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nope. STill i face the same error. Can someone help in this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you find an answer for this?
Observe and Secure All Apps with Splunk
What's New in Splunk Observability - August 2025
Introduction to Splunk AI
