Getting Data In

Time out error encountered for connection from host

remy06
Contributor

Hi,

I have encountered errors from a host that is sending data to the splunk server(running on linux) via port 9997.All along it is working fine till last two days.

The error encountered in splunkd was:
Error TcpInputProc: Error encountered for connection from host=1.2.3.4,ip=1.2.3.4. Timeout.

So far there are no issues with other hosts on port 9997 except for this.

Does this indicate that the problem lies with the splunk server itself or the host that is sending data?

Am able to telnet from the host to the splunk server on port 9997.In this case there is no firewall blocking,which I initially suspect due to the iptables that i've enabled yesterday,but this host has stopped sending data since the last two days.

jtrucks
Splunk Employee
Splunk Employee

Run tcpdump or the like to sniff the traffic and correlate tcp events (and gaps in timestamps) with this error to see what your issue is. It could be an unrelated network issue that slows things down, but looking at the raw data and packet metadata may help.

--
Jesse Trucks
Minister of Magic
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...