Getting Data In

Why am I receiving warning in Splunk log for timedout?

vikrghos
New Member

Getting warning for all our forwarders - is there any problem 

 

03-30-2023 05:00:23.265 +0530 INFO AutoLoadBalancedConnectionStrategy [7124 TcpOutEloop] - Connected to idx=10.22.91.231:9997, pset=1, reuse=0. using ACK.
03-30-2023 05:00:25.234 +0530 INFO AutoLoadBalancedConnectionStrategy [7124 TcpOutEloop] - After randomization, current is first in the list. Swapping with last item
03-30-2023 05:00:25.531 +0530 WARN AutoLoadBalancedConnectionStrategy [6916 TcpOutEloop] - Cooked connection to ip=10.22.91.231:9997 timed out
03-30-2023 05:00:25.531 +0530 INFO AutoLoadBalancedConnectionStrategy [7148 TcpOutEloop] - Closing stream for idx=3.81.182.58:9997
03-30-2023 05:00:25.531 +0530 INFO AutoLoadBalancedConnectionStrategy [7148 TcpOutEloop] - Connected to idx=10.22.91.231:9997, pset=5, reuse=0. using ACK.
03-30-2023 05:00:26.109 +0530 WARN AutoLoadBalancedConnectionStrategy [6236 TcpOutEloop] - Cooked connection to ip=10.22.91.231:9997 timed out

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Timeout means that one side performed some operation and waited for a result which didn't occur. In thes case it means that the forwarder tried to establish connection to a given ip:port but the receiver didn't respond in time to the connection request. It is typically an issue with your network configuration (routing, firewalling, filtering on the destination host).

0 Karma

vinoth_raj
Path Finder

A similar issue is discussed in the link below:

https://community.splunk.com/t5/Getting-Data-In/How-can-I-overcome-TCP-cooked-connection-timeout/m-p...

 

 

If it helps, give a karma.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...