I followed by this doc http://answers.splunk.com/answers/147295/how-do-i-send-my-own-data-into-a-splunk-cloud-sandbox-trial.html and my outputs.conf like below [tcpout] defaultGroup = sandbox [tcpout:sandbox] server = input-prd-p-xxxxxxxxxx.cloud.splunk.com:9997 but I got err msg from my splunkd.log like below 01-09-2015 00:26:35.174 -0800 INFO TcpOutputProc - Connected to idx=54.165.154.169:9997 01-09-2015 00:26:35.251 -0800 ERROR TcpOutputFd - Read error. Connection reset by peer 01-09-2015 00:26:35.251 -0800 INFO TcpOutputProc - Connection to 54.165.154.169:9997 closed. Read error. Connection reset by peer 01-09-2015 00:26:35.251 -0800 WARN TcpOutputProc - Applying quarantine to ip=54.165.154.169 port=9997 _numberOfFailures=9 01-09-2015 00:29:34.969 -0800 INFO TcpOutputProc - Removing quarantine from idx=54.165.154.169:9997 in my sandbox UI it showed Listen on this port Status Actions 9997 Enabled I think that port should be enabled, but my forwarder still can't connect to that. how can I fix this? ... View more