Deployment Architecture

My forwarder can't connect to my splunk cloud sandbox

xzhao
Engager

I followed by this doc
http://answers.splunk.com/answers/147295/how-do-i-send-my-own-data-into-a-splunk-cloud-sandbox-trial...

and my outputs.conf like below

[tcpout]
defaultGroup = sandbox

[tcpout:sandbox]
server = input-prd-p-xxxxxxxxxx.cloud.splunk.com:9997

but I got err msg from my splunkd.log like below

01-09-2015 00:26:35.174 -0800 INFO TcpOutputProc - Connected to idx=54.165.154.169:9997
01-09-2015 00:26:35.251 -0800 ERROR TcpOutputFd - Read error. Connection reset by peer
01-09-2015 00:26:35.251 -0800 INFO TcpOutputProc - Connection to 54.165.154.169:9997 closed. Read error. Connection reset by peer
01-09-2015 00:26:35.251 -0800 WARN TcpOutputProc - Applying quarantine to ip=54.165.154.169 port=9997 _numberOfFailures=9
01-09-2015 00:29:34.969 -0800 INFO TcpOutputProc - Removing quarantine from idx=54.165.154.169:9997

in my sandbox UI it showed

Listen on this port Status Actions
9997
Enabled

I think that port should be enabled, but my forwarder still can't connect to that.

how can I fix this?

0 Karma

yannK
Splunk Employee
Splunk Employee

You need to remove your custom outputs.conf, and download the splunkcloud forwarder credendials (from the app "universal forwarder" in the UI of the cloud sandbox instance)
Otherwise you may have a conflict with the defaultGroup definition. If you are not sure, use btool to verify,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...