Getting Data In

TCP Cooked connection ?

lain179
Communicator

Why is this happening?

11-13-2012 16:40:04.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:12.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:33.779 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:34.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:34.778 +0000 WARN  TcpOutputProc - Applying quarantine to ip=IPADDRESS  port=PORT#_numberOfFailures=2
11-13-2012 16:40:54.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out

Tags (2)

nathanjenkins
Engager

Cooked connection means that somewhere along the network your SSL connection is being blocked.

  • Could be the indexer is not configured with the right certificate to accept encrypted connections
  • a firewall is blocking the connection
  • also remember always restart splunk after any configuration changes in order for them to take effect

To identify the cause of the problem visit:
http://www.visicoretech.com/splunk/splunk-troubleshooting-forwarder/

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"cooked" refers to data that has already been processed by an indexer or heavy forwarder.

---
If this reply helps you, Karma would be appreciated.

hagjos43
Contributor

We currently have this issue too. I'm running a lot of scenarios and with no luck thus far.

0 Karma

paul_1994
Path Finder

Or can someone give an explanation of what it means?

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...