Just to be clear:
"TcpOutputProc - Cooked connection to ip=x.x.x.x:9997 timed out"
Is not necessarily a problem - It can just indicate a network connection between splunk components has stopped sending data and has naturally timed out - as would any other TCP connection.
You could well be chasing a red-herring - if your forwarders are not able to communicate with your indexers, you wouldn't see any internal logs.
If you are seeing internal logs, its almost certainly config related, and not a network issue.
I would check that your indexes are properly defined, and that your inputs specify the correct index definitions
... View more