forwarder

[SN1]

hello we are unable to receive logs from forwarders from 29 january. i checked splund.log and found this error
ERROR TcpOutputFd [110883 TcpOutEloop] - Connection to host=<ip>:port failed

what should I do?

[gcusello]

Hi @SN1 ,

probably that day someone closed the firewall port between Forwarder and Indexer.

The port should be 9997.

if this is the port, you can try using telnet from the Forwarder:

telnet <host_ip> <port>

Ciao.

Giuseppe

[SN1]

hello after this command on deployment server it is showing this error


telnet: Unable to connect to remote host: Connection refused

[SanjayReddy]

Hi @SN1 

telent command need to run on forwader as mentioned by @gcusello and also hope you followed stpes menioned by @livehybrid 

[livehybrid]

The error you're seeing suggests a network connectivity issue between your forwarder and the receiving Splunk instance (likely an Indexer or Heavy Forwarder).

Here are some steps to troubleshoot:

Verify network connectivity: -

• Can you connect to the destination host from the forwarder (Try using netcat with something like `nc -vz -w1 <destinationIP> <destinationPort>`
• Is the specified port open and accessible on the destination server (Is Splunk listening?)
• Are any other hosts able to connect and send data?
• Check firewall rules: - Ensure no firewall is blocking the connection on either end.
• Verify Splunk configurations: - On the forwarder, check outputs.conf for correct destination settings. - On the receiving end, verify inputs.conf for proper port configurations.
• Restart Splunk services: - Sometimes a restart can resolve connectivity issues, try restarting the forwarder, if no progress then try restart Splunk on the receiver to confirm it is working correctly.
• Check for any recent network changes - Were there any infrastructure modifications around January 29th?
  

Please let me know how you get on and consider upvoting/karma this answer if it has helped.
Regards

Will