Getting Data In

Why am I receiving warning in Splunk log for timedout?

vikrghos
New Member

Getting warning for all our forwarders - is there any problem 

 

03-30-2023 05:00:23.265 +0530 INFO AutoLoadBalancedConnectionStrategy [7124 TcpOutEloop] - Connected to idx=10.22.91.231:9997, pset=1, reuse=0. using ACK.
03-30-2023 05:00:25.234 +0530 INFO AutoLoadBalancedConnectionStrategy [7124 TcpOutEloop] - After randomization, current is first in the list. Swapping with last item
03-30-2023 05:00:25.531 +0530 WARN AutoLoadBalancedConnectionStrategy [6916 TcpOutEloop] - Cooked connection to ip=10.22.91.231:9997 timed out
03-30-2023 05:00:25.531 +0530 INFO AutoLoadBalancedConnectionStrategy [7148 TcpOutEloop] - Closing stream for idx=3.81.182.58:9997
03-30-2023 05:00:25.531 +0530 INFO AutoLoadBalancedConnectionStrategy [7148 TcpOutEloop] - Connected to idx=10.22.91.231:9997, pset=5, reuse=0. using ACK.
03-30-2023 05:00:26.109 +0530 WARN AutoLoadBalancedConnectionStrategy [6236 TcpOutEloop] - Cooked connection to ip=10.22.91.231:9997 timed out

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Timeout means that one side performed some operation and waited for a result which didn't occur. In thes case it means that the forwarder tried to establish connection to a given ip:port but the receiver didn't respond in time to the connection request. It is typically an issue with your network configuration (routing, firewalling, filtering on the destination host).

0 Karma

vinoth_raj
Path Finder

A similar issue is discussed in the link below:

https://community.splunk.com/t5/Getting-Data-In/How-can-I-overcome-TCP-cooked-connection-timeout/m-p...

 

 

If it helps, give a karma.

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...