OS=Windows Server 2008 SP1 64-bit, Forwarder version = 5.0, Indexer version = 5.0
Windows Firewall = OFF
Scenario = Win VM on same network as Linux VM running the indexer
TcpOutputProc - Cooked connection to ip=192.168.1.10:9997 timed out
CMConfig - A splunktcp forwarder port is not configured in inputs.conf
defaultGroup = default-autolb-group
server = 192.168.1.10:9997
host = PIZZA
I don't think i have to configure any port in the inputs.conf file. I already researched that the CMConfig error is a known bug.
Seems like it is a "known issue" with 5.0 but not sure if it affects the functionality of the Forwarder.
"A splunktcp forwarder port is not configured in inputs.conf" error message appears on forwarder/search head/master when it should only appear on the affected slave. (SPL-56019)
Also, you need to make sure nothing is blocking your ability to get there on the indexer side. I would recommend from the Windows machine trying to
telnet 192.168.1.10 9997 and see if you can connect with that. It is likely there is a iptables firewall on the linux host blocking your connection.
On the indexer(s), you must configure a receiving port in inputs.conf
On the forwarder(s), you must configure the same port in outputs.conf. Also on the forwarder(s), you will need to have inputs.conf to collect the data that will be sent to the indexer(s).
There are more details in the manual at Set up forwarding and receiving.