Hi,
I have installed splunk 9.4.2 on-prem and downloaded and installed the 'splunkuf' app from splunkcloud universal forwarder package. Upon restarting the splunk instance, it throws following errors. I just want to ensure the internal logs reach cloud before i configure the server with custom apps/add-ons.
05-14-2025 13:05:23.918 +0000 ERROR TcpOutputFd [2377196 TcpOutEloop] - Connection to host=18.xx:9997 failed. sock_error = 104. SSL Error = No error
I have checked connectivity from on-prem instance to inputs1.*.splunkcloud.com:9997 using curl/telnet and openssl and firewall team confirmed the ports are open.
Any thoughts on what I could be missing or suggestions to troubleshoot?
thanks
laks
Hi @lakshman239
I would ask the firewall to check/show that the traffic is not being blocked. I spent a lot of time with a customer recently who told me we had a direct connection to Splunk Cloud when infact it went via some PaloAlto firewalls which were occasionally blocking, when it blocked it gave that exact error.
If you're able to do the usual netcat/openssl tests that it shows your connectivity should be okay so hard to pinpoint.
Check out https://community.splunk.com/t5/Deployment-Architecture/Connection-problems-with-Universal-Forwarder... which has some more detail too about.
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing
Hi @lakshman239
I would ask the firewall to check/show that the traffic is not being blocked. I spent a lot of time with a customer recently who told me we had a direct connection to Splunk Cloud when infact it went via some PaloAlto firewalls which were occasionally blocking, when it blocked it gave that exact error.
If you're able to do the usual netcat/openssl tests that it shows your connectivity should be okay so hard to pinpoint.
Check out https://community.splunk.com/t5/Deployment-Architecture/Connection-problems-with-Universal-Forwarder... which has some more detail too about.
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing
Thanks @livehybrid The issue was at the firewall side. It was dropping packets, so the policies/rules had to applied again.
Also added some useful link which i came across.