Skip to main content
Question

Any suggestions for a destination facing severe issues: Write ECONNRESET error

  • Mar 11, 2025 3:16 AM UTC
  • 7 replies
  • 215 views

Destination is presently experiencing severe problems. Below are details -error is Write ECONNRESETany suggestion how to fix this ?the same destination is receiving another log stream very well

7 replies

xpac
Forum|alt.badge.img
  • Inspiring
  • Mar 11, 2025 4:24 AM UTC

Look at the IDX, it should tell you why it's resetting the connection


  • Author
  • Known Participant
  • Mar 11, 2025 4:25 AM UTC

i changed the max s2s version from v4 to v3 as wellstill the same issue


  • Author
  • Known Participant
  • Mar 11, 2025 4:25 AM UTC

splunk internal logs error --- error 140760FC:SSL routines: SSL23_GET_CLIENT_HELLO:unknown protocol


xpac
Forum|alt.badge.img
  • Inspiring
  • Mar 11, 2025 4:25 AM UTC

One side is configured to use TLS, the other is not


xpac
Forum|alt.badge.img
  • Inspiring
  • Mar 11, 2025 4:25 AM UTC

My guess is Cribl is not, but Splunk expects TLS


  • Author
  • Known Participant
  • Mar 11, 2025 4:25 AM UTC

Yup. Client hello handshake issue


  • Author
  • Known Participant
  • Mar 11, 2025 4:25 AM UTC

I encrypted my outward stream. works like charm