Getting Data In

TcpOutputProc - Cooked connection to ip=timed out

brod_geico
Path Finder

Im getting below error on my heavy forwarder logs, 6 indexers are connect that HF , 4 indexers are working fine.
Only problem with 2 indexers and the same indexers are working fine for other network servers.This issue only one location.
TcpOutputProc - Cooked connection to ip=x.x.x.x.:9997 timed out

As pert of troubleshooting i have done all below things.

Added splunk:TCP ports to indexer inputs.conf and try to accept it IP|DNS|NONE but no luck.
/etc/hosts files updated the FQDN name on both sides.
Ping and trace root working fine.
All the ports are opened and FW rules are enabled.
Any thing im missing here?

0 Karma
1 Solution

brod_geico
Path Finder

Thanks i have found the issue network team not enabled VPN firewall rules that is the pronlem
Data center firewalls would cause the from VPN issue for splunk that should all be allowed now

View solution in original post

0 Karma

brod_geico
Path Finder

Thanks i have found the issue network team not enabled VPN firewall rules that is the pronlem
Data center firewalls would cause the from VPN issue for splunk that should all be allowed now

0 Karma

aliakseidzianis
Path Finder

It was a firewall issue for me too.

0 Karma

harsmarvania57
Ultra Champion

Check your indexers queue, whether indexers queues are running full.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...