Sending data from onprem splunk to cloud - SSL error

[lakshman239]

Hi, 

 I have installed splunk 9.4.2 on-prem and downloaded and installed the 'splunkuf' app from splunkcloud universal forwarder package. Upon restarting the splunk instance, it throws following errors. I just want to ensure the internal logs reach cloud before i configure the server with custom apps/add-ons.

05-14-2025 13:05:23.918 +0000 ERROR TcpOutputFd [2377196 TcpOutEloop] - Connection to host=18.xx:9997 failed. sock_error = 104. SSL Error = No error

I have checked connectivity from on-prem instance to inputs1.*.splunkcloud.com:9997 using curl/telnet and openssl and firewall team confirmed the ports are open.

Any thoughts on what I could be missing or suggestions to troubleshoot?

thanks

laks

[livehybrid · Accepted solution]

Hi @lakshman239 

I would ask the firewall to check/show that the traffic is not being blocked. I spent a lot of time with a customer recently who told me we had a direct connection to Splunk Cloud when infact it went via some PaloAlto firewalls which were occasionally blocking, when it blocked it gave that exact error.

If you're able to do the usual netcat/openssl tests that it shows your connectivity should be okay so hard to pinpoint. 

Check out https://community.splunk.com/t5/Deployment-Architecture/Connection-problems-with-Universal-Forwarder... which has some more detail too about.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[lakshman239]

Thanks @livehybrid  The issue was at the firewall side. It was dropping packets, so the policies/rules had to applied again.

Also added some useful link which i came across.

https://community.splunk.com/t5/Security/ERROR-TcpOutputFd-Connection-to-host-c-9997-failed-sock-err... 

https://splunk.my.site.com/customer/s/article/Splunk-Universal-Forwarder-is-not-sending-events-to-Sp...