Getting Data In

HF can't reach splunk cloud

wxlcba
Loves-to-Learn

I've created the HF, and set up the ip allow list. From the Azure Connection troubleshoot, the testing is successful, NSG has createa and allow all connection to internet, then Windows firewall is disabled in the VM.

but I still get this error.

06-16-2024 22:59:24.253 +0000 WARN AutoLoadBalancedConnectionStrategy [8760 TcpOutEloop] - Cooked connection to ip=1.2.3.4:9997 timed out
06-16-2024 22:59:24.563 +0000 ERROR TcpOutputFd [8760 TcpOutEloop] - Read error. An existing connection was forcibly closed by the remote host.
06-16-2024 22:59:24.876 +0000 ERROR TcpOutputFd [8760 TcpOutEloop] - Read error. An existing connection was forcibly closed by the remote host.

 

running the comand netstat -anob to check the connections it will be stuck in the SYN_SENT status. but the messages said HF has been blocked for blocked_seconds=10

any ideas for fixing this issues?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @wxlcba ,

in addition to the checks hinted by @deepakc ,

did you downloaded and installed on your HFs the forwarder app from SplunkCloud? it contains the configuration for the connection.

Ciao.

Giuseppe

0 Karma

deepakc
Builder

It could be several things blocking you.

TcpOutputFd (this is normally a networking or config setting) 

You have set the whitelist and disabled the FW.

Other things to check:

  1. Check your network allows for the HF to route outbound to Splunk cloud
  2. Deploy the Splunk Credentials Package to the HF - https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/ConfigSCUFCredentials
  3. Check you can connect – try this command: 

 

 

 openssl s_client -connect inputs1.MY_STACK_NAME>.splunkcloud.com:9997​

 

 

 Further than that more troubleshooting is required. But it’s usually a networking that’s blocking.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...