Update :  It was effectively a misconfiguration of the network.  I haven't found a solution for this problem, so I worked around by making an instance of splunk enterprise in a docker container instead of a VM, and now I can see my docker's logs on Splunk enterprise. Traceroute showed me that sending packets from the container to the VM doesn't work. In the other way, it's functioning correctly. (I tried this after flushing all iptables rules and verifying that there wasn't any firewalld service activated.)   Thank you all for your help !   ... View more

Yes, it's the tcpdump of the VM, where is the splunk enterprise instance.  Are virtualbox or docker naturally blocking tcp packets ?    When I rerun the same tcpdump, it prints when I finish it 10 packets captured 10 packets received by filter 0 packets dropped by kernel       ... View more

I checked the document.   The tcpdump steps got me this output : 14:37:55.532330 IP 172.17.0.3.49854 > debian.9997: Flags [S], seq 1200675435, win 64240, options [mss 1460,sackOK,TS val 3005873483 ecr 0,nop,wscale 10], length 0 14:37:56.553739 IP 172.17.0.3.49854 > debian.9997: Flags [S], seq 1200675435, win 64240, options [mss 1460,sackOK,TS val 3005874504 ecr 0,nop,wscale 10], length 0 14:37:58.569660 IP 172.17.0.3.49854 > debian.9997: Flags [S], seq 1200675435, win 64240, options [mss 1460,sackOK,TS val 3005876520 ecr 0,nop,wscale 10], length 0 14:38:02.793699 IP 172.17.0.3.49854 > debian.9997: Flags [S], seq 1200675435, win 64240, options [mss 1460,sackOK,TS val 3005880744 ecr 0,nop,wscale 10], length 0 14:38:10.985799 IP 172.17.0.3.49854 > debian.9997: Flags [S], seq 1200675435, win 64240, options [mss 1460,sackOK,TS val 3005888936 ecr 0,nop,wscale 10], length 0 14:38:15.454976 IP 172.17.0.3.49856 > debian.9997: Flags [S], seq 447694644, win 64240, options [mss 1460,sackOK,TS val 3005893405 ecr 0,nop,wscale 10], length 0 14:38:16.458322 IP 172.17.0.3.49856 > debian.9997: Flags [S], seq 447694644, win 64240, options [mss 1460,sackOK,TS val 3005894408 ecr 0,nop,wscale 10], length 0 14:38:18.473564 IP 172.17.0.3.49856 > debian.9997: Flags [S], seq 447694644, win 64240, options [mss 1460,sackOK,TS val 3005896424 ecr 0,nop,wscale 10], length 0 14:38:22.505569 IP 172.17.0.3.49856 > debian.9997: Flags [S], seq 447694644, win 64240, options [mss 1460,sackOK,TS val 3005900456 ecr 0,nop,wscale 10], length 0 14:38:30.697704 IP 172.17.0.3.49856 > debian.9997: Flags [S], seq 447694644, win 64240, options [mss 1460,sackOK,TS val 3005908648 ecr 0,nop,wscale 10], length 0  I suppose that a length of 0 for tcp packets isn't normal ? ... View more

Hi PickleRick, dhirendra761,    Thank you for these quick answers and your help ! Telnet can't connect when I type :    telnet 172.17.0.10 9997 on the docker container.    /opt/splunkforwarder/etc/system/local/outputs.conf : [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server=172.17.0.10 [tcpout-server://172.17.0.10:9997]   splunkd.log on container print these warnings. 03-28-2022 13:10:54.135 +0200 WARN AutoLoadBalancedConnectionStrategy [439 TcpOutEloop] - Cooked connection to ip=172.17.0.10:9997 timed out TcpOutputProc [438 parsing] - The TCP output processor has paused the data flow. Forwarding to host_dest=172.17.0.10 inside output group default-autolb-group from host_src=b2e058553000 has been blocked for blocked_seconds=5600. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.   command "splunk list monitor" print log files and directories. seems like there is nothing wrong, there.   I'm sorry if there are missing informations    ... View more