Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: TcpOutputProc - Cooked connection to ip=timed ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Im getting below error on my heavy forwarder logs, 6 indexers are connect that HF , 4 indexers are working fine.
Only problem with 2 indexers and the same indexers are working fine for other network servers.This issue only one location.
TcpOutputProc - Cooked connection to ip=x.x.x.x.:9997 timed out
As pert of troubleshooting i have done all below things.
Added splunk:TCP ports to indexer inputs.conf and try to accept it IP|DNS|NONE but no luck.
/etc/hosts files updated the FQDN name on both sides.
Ping and trace root working fine.
All the ports are opened and FW rules are enabled.
Any thing im missing here?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks i have found the issue network team not enabled VPN firewall rules that is the pronlem
Data center firewalls would cause the from VPN issue for splunk that should all be allowed now
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks i have found the issue network team not enabled VPN firewall rules that is the pronlem
Data center firewalls would cause the from VPN issue for splunk that should all be allowed now
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It was a firewall issue for me too.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check your indexers queue, whether indexers queues are running full.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Classic British Rock Bands
New to the Community? Join Us for an Exclusive Post .conf26 Welcome Session (Plus a ...
Accelerate Splunk App Development with AI
