I'm seeing this message in the splunkd.log file just before a Universal Forwarder starts a shutdown.
11-25-2017 18:38:11.690 -0800 INFO NetUtils - Connect timeout - waited for 5 seconds. ip=aaa.bbb.ccc.ddd port=8089
11-25-2017 18:38:11.690 -0800 WARN HTTPClient - Connect to=deployment_server:8089 timed out; exceeded 5sec
11-25-2017 18:38:11.690 -0800 WARN HTTPClient - Download file cancelled due to: Connect to=deployment_server:8089 timed out; exceeded 5sec
I'm trying to figure out if the value of 5 seconds can be changed. I haven't found any file with 5 seconds in it. Any ideas where the value of 5 seconds comes from?
You can specify a different check-in interval on a per client, or per class basis by tuning the phoneHomeIntervalInSecs and handshakeRetryIntervalInSecs parameters in deploymentclient.conf: