Getting Data In

TCP Cooked connection ?

lain179
Communicator

Why is this happening?

11-13-2012 16:40:04.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:12.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:33.779 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:34.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out
11-13-2012 16:40:34.778 +0000 WARN  TcpOutputProc - Applying quarantine to ip=IPADDRESS  port=PORT#_numberOfFailures=2
11-13-2012 16:40:54.778 +0000 WARN  TcpOutputProc - Cooked connection to ip=IPADDRESS timed out

Tags (2)

nathanjenkins
Engager

Cooked connection means that somewhere along the network your SSL connection is being blocked.

  • Could be the indexer is not configured with the right certificate to accept encrypted connections
  • a firewall is blocking the connection
  • also remember always restart splunk after any configuration changes in order for them to take effect

To identify the cause of the problem visit:
http://www.visicoretech.com/splunk/splunk-troubleshooting-forwarder/

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"cooked" refers to data that has already been processed by an indexer or heavy forwarder.

---
If this reply helps you, Karma would be appreciated.

hagjos43
Contributor

We currently have this issue too. I'm running a lot of scenarios and with no luck thus far.

0 Karma

paul_1994
Path Finder

Or can someone give an explanation of what it means?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...