It seems that your target is SCP environment. Are you using SCP’s Universal Forwarder package from SCP? Based on those server names you have something else than AWS Victoria experience in use or otherwise you have wrong outputs.conf in use. ... View more

@MrBLeu  If SSL is being used, ... To do an openssl test like openssl s_client -connect xx.xx.xx.xx:9997 -cert <cert_file> -CAfile <ca_file> You can get <ca_file> from running this: /opt/splunk/bin/splunk cmd btool server list sslConfig | grep sslRootCAPath <cert_file> you can get from running this: /opt/splunk/bin/splunk cmd btool outputs list tcpout You are looking for the clientCert setting. If you have multiple entries for clientCert, such as one under [tcpout] and one under [tcpout:<group>], pick the one on the latter, which would be at the more specific level. You'll be able to see if ssl handshake is completing properly with the settings currently configured. ... View more

Thanks! ... View more