Getting Data In

How to troubleshoot error "TcpOutputFd - Connection to xxx host failed." on the forwarder?

pb0543
Explorer

I am getting a TcpOutputFd on the forwarder. Connection to xxx host failed.

4-22-2015 16:17:34.736 -0400 WARN  TcpOutputFd - Connect to :9997 failed. Connection refused
04-22-2015 16:17:34.745 -0400 ERROR TcpOutputFd - Connection to host=xxxxxx:9997 failed
04-22-2015 16:17:34.747 -0400 INFO  TcpOutputProc - Detected idx=hostname:9997 shutting down
04-22-2015 16:17:34.747 -0400 INFO  TcpOutputProc - Will close stream to current indexer xxxxxx

I removed the host ip and replaced with xxx. Where should I investigate this issue?

0 Karma
1 Solution

pb0543
Explorer

Thanks to everyone. I found the tcp port was not setup in the inputs.conf file. Added the tcp entry and it is working.

View solution in original post

0 Karma

pb0543
Explorer

Thanks to everyone. I found the tcp port was not setup in the inputs.conf file. Added the tcp entry and it is working.

0 Karma

neelamssantosh
Contributor

Firstly, on Forwarder check to which instances it is sending the data to using
1. /opt/splunk/bin/splunk btool outputs lists --debug
once u get the output list(IP's)
2. Ping the IP's/IDX to check the connectivity

Go to the respective IP's/IDX and check the instance status
1. Server is up and running
2. Look for listening ports(netstat -an)
3. Check Splunk status and also the splunkd.logs

MuS
Legend

Hi pb0543,

usually a message connection refused means that the remote server is not listening on the requested port. So check if you enabled receiving on your indexer http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Enableareceiver and you're able to connect from the forwarder to the receiving port of the indexer (network routes, firewall and so on).

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...