Getting Data In

Cooked connection to ip timed out

joliver
New Member

We already have universal forwarders set up on multiple servers that are working fine. I have installed a new universal forwarder on a different server, but cannot make a connection to the indexer. I am using the same configurations as the forwarders that are working, but am receiving the error below. I have already tried adding [splunktcp://9997] and Connection_host = none to inputs.conf, then restarting Splunk, but this had no effect. Anyone know what causes this error? Thanks for any advice you could provide. This is driving me nuts!

Here's the error:
-0500 WARN TcpOutputProc - Cooked connection to ip=xx.x.xxx.xxx:4444 timed out

Here's my inputs.conf:
[default]
host = my server name

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

Here's my outputs.conf:
[tcpout]
defaultGroup = xx.x.xxx.xxx_4444
disabled = false

[tcpout:xx.x.xxx.xxx_4444]
server = xx.x.xxx.xxx:4444

[tcpout-server://xx.x.xxx.xxx:4444]

0 Karma
1 Solution

masonmorales
Influencer

You can also identify firewall issues by using the telnet command on your forwarder...

telnet <indexer_ip> <indexer port>

If you don't receive a "connected to ......" message, it's usually a firewall issue.

View solution in original post

masonmorales
Influencer

You can also identify firewall issues by using the telnet command on your forwarder...

telnet <indexer_ip> <indexer port>

If you don't receive a "connected to ......" message, it's usually a firewall issue.

joliver
New Member

This ended up being a firewall issue.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...