Getting Data In

Time out error encountered for connection from host

remy06
Contributor

Hi,

I have encountered errors from a host that is sending data to the splunk server(running on linux) via port 9997.All along it is working fine till last two days.

The error encountered in splunkd was:
Error TcpInputProc: Error encountered for connection from host=1.2.3.4,ip=1.2.3.4. Timeout.

So far there are no issues with other hosts on port 9997 except for this.

Does this indicate that the problem lies with the splunk server itself or the host that is sending data?

Am able to telnet from the host to the splunk server on port 9997.In this case there is no firewall blocking,which I initially suspect due to the iptables that i've enabled yesterday,but this host has stopped sending data since the last two days.

jtrucks
Splunk Employee
Splunk Employee

Run tcpdump or the like to sniff the traffic and correlate tcp events (and gaps in timestamps) with this error to see what your issue is. It could be an unrelated network issue that slows things down, but looking at the raw data and packet metadata may help.

--
Jesse Trucks
Minister of Magic
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...