Why can't I connect to Splunk Cloud from heavy forwarder?

[hkumar8]

I am unable to connect from HF (on windows) to splunk cloud.

receiving is enabled on splunk cloud and HF as well on port 9997. Forwarding is enabled on HF to splunk cloud on port 9997
getting below error:

09-14-2017 14:16:39.042 -0700 WARN TcpOutputProc - Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group splunkcloud has been blocked for 1222102 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.

[esix_splunk]

Have you checked that your firewall rules allow outbound connections on TCP9997, specifically to your Splunk Cloud Hosts?

[hkumar8]

Thanks. do I need to check for port 8089 as well?

[hkumar8]

Checked the firewall connections no block anywhere.

But I cannot telnet on port 9997 or 8089.

Tracert is able to reach to splunk cloud (search head).

netstat -an
shows a syn request sent by HF to SH on port 9997

what else can I look for?

[esix_splunk]

What platform are you running on? Windows Or Linux? Is this a corporate network, or on a personal computer?

I would completely disable your host based Firewalls (iptables, windows defender etc.) to validate that its not a host based firewall issue. Outside of that, if you're on a corporate network you should contact your LAN/WAN administrator and validate that they are not blocking / filtering outbound traffic.

[hkumar8]

This is on Windows corporate network.
local windows firewall is disabled. Traffic to internet is open from this box. I can connect anywhere and network team confirmed no blocking/filtering ppolicy is applied.

[shubham92]

Did you get a solution to this problem ?