We started to lose accessing Splunkweb running on Windows 2k8 Server. When we checked status of the service. We've noticed that the splunkweb service went down. So, I restarted splunkd and splunkweb. But, soon after splunkweb stoped. I tried it from DOS CLI. The output says that splunkd and splunkweb started successfully. But, Splunk status shows splunkweb is not running. I took a look at splunkd.log. There were a lot of following errors;
For non-Splunk related application, definitely "netstat -an" and check which other apps are using sockets, and narrow down to applications which is possibly causing the issue.
Unfortunately, in my a few experiences of Splunk cases, they did not show so many network tcp or udp sessions as output of netstat -an. So, that output itself did not help much to identify a cause of the issue. At least you can check which ports are being used.
According to Microsoft, winsocket error 10055 means that your socket or pipe is failing due to lack of buffer.
When this happens, not only Splunk ports but also other general ports cannot be accessed. Telnet to any port would fail most likely. So, Splunk might not be causing the issue.
You have to reboot your machine to get rid of the error. But if you cannot identify a cause of the issue, eventually the same error might come back.
For Splunk, you should check your splunkd.log and see any errors related to network; such as Deployment Server, Deployment Client, TcpOutputFd, TcpOutputProc, TcpInputFd, TcpInputProc etc. Then, check if configuration file is okay, and network issue such as slow Reverse DNS or DNS lookup.
The last time we solved the issue Deployment Server and Deployment Client were running on the same Splunk instance. But, the configuration was not proper. As a result, there were a lot of Deployment Client connection errors.