I also got sock_error = 104 when attempting connections to Splunk Cloud.
07-01-2019 15:45:03.234 +0000 ERROR TcpOutputFd - Connection to host=12.34.56.78:9997 failed. sock_error = 104. SSL Error = No error
In my case, the root cause was an upstream device doing SSL inspection (so accepting the TCP connection), but dropping the traffic after it failed to decrypt (because Splunk Cloud uses pre-shared keys instead of a key exchange).
... View more