Getting Data In

rsyslog no send logs in specific ip range

splunkcol
Builder

Hi,

I have 2 indexers

with the command I confirm that port 9997 is open.

In one of the two indexers all the incoming connections remain in the "SYN_RECV" state

In the other indexer some are in the "SYN_RECV" state and others are "ESTABLISHED"

The funny thing is that one ip range if connected and the other ip range does not

tcpdump is a relative test, because those in the "ESTABLISHED" state are not recognized by ping, telnet, or sniffer but deliver the logs to the indexer and the indexer to the search head and are displayed normally

The firewall area says that the policies are correct.

I am guaranteeing that port 9997 is in the listening state, is it a splunk configuration problem, or is it a transmission level network policy problem?


tcp 0 0 0.0.0.0:9997 0.0.0.0:* LISTEN
tcp 0 0 172.27.29.71:9997 192.168.71.13:49603 SYN_RECV
tcp 0 0 172.27.29.71:9997 192.168.71.13:49601 SYN_RECV
tcp 0 0 172.27.29.71:9997 192.168.70.17:59856 ESTABLISHED
tcp 315 0 172.27.29.71:9997 192.168.70.16:56015 ESTABLISHED
tcp 0 0 172.27.29.71:9997 192.168.71.12:57122 SYN_RECV
tcp 0 0 172.27.29.71:9997 192.168.70.14:51241 ESTABLISHED
tcp 0 0 172.27.29.71:9997 192.168.71.13:49605 SYN_RECV
tcp 0 0 172.27.29.71:9997 192.168.71.12:57119 SYN_RECV
tcp 3877460 0 172.27.29.71:9997 172.29.4.39:34311 ESTABLISHED
tcp 0 0 172.27.29.71:9997 192.168.71.13:49598 SYN_RECV
tcp 3211190 0 172.27.29.71:9997 192.168.70.12:55205 ESTABLISHED

0 Karma
1 Solution

splunkcol
Builder

 

with the command netstat -an | grep 9997 you are guaranteeing that the server has the port open and in the listening state

The problem was due to the policies of one of the firewalls

View solution in original post

0 Karma

splunkcol
Builder

 

with the command netstat -an | grep 9997 you are guaranteeing that the server has the port open and in the listening state

The problem was due to the policies of one of the firewalls

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...