Getting Data In

HF can't reach splunk cloud

wxlcba
Loves-to-Learn

I've created the HF, and set up the ip allow list. From the Azure Connection troubleshoot, the testing is successful, NSG has createa and allow all connection to internet, then Windows firewall is disabled in the VM.

but I still get this error.

06-16-2024 22:59:24.253 +0000 WARN AutoLoadBalancedConnectionStrategy [8760 TcpOutEloop] - Cooked connection to ip=1.2.3.4:9997 timed out
06-16-2024 22:59:24.563 +0000 ERROR TcpOutputFd [8760 TcpOutEloop] - Read error. An existing connection was forcibly closed by the remote host.
06-16-2024 22:59:24.876 +0000 ERROR TcpOutputFd [8760 TcpOutEloop] - Read error. An existing connection was forcibly closed by the remote host.

 

running the comand netstat -anob to check the connections it will be stuck in the SYN_SENT status. but the messages said HF has been blocked for blocked_seconds=10

any ideas for fixing this issues?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @wxlcba ,

in addition to the checks hinted by @deepakc ,

did you downloaded and installed on your HFs the forwarder app from SplunkCloud? it contains the configuration for the connection.

Ciao.

Giuseppe

0 Karma

deepakc
Builder

It could be several things blocking you.

TcpOutputFd (this is normally a networking or config setting) 

You have set the whitelist and disabled the FW.

Other things to check:

  1. Check your network allows for the HF to route outbound to Splunk cloud
  2. Deploy the Splunk Credentials Package to the HF - https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/ConfigSCUFCredentials
  3. Check you can connect – try this command: 

 

 

 openssl s_client -connect inputs1.MY_STACK_NAME>.splunkcloud.com:9997​

 

 

 Further than that more troubleshooting is required. But it’s usually a networking that’s blocking.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...