sslCertPath = $SPLUNK_HOME/etc/apps/splunkclouduf/default/client.pem
sslPassword = fdf1c4601674ddd5fca3db0486d927db
sslRootCAPath = $SPLUNK_HOME/etc/apps/splunkclouduf/default/cacert.pem
but for you information :
Other reasons the forwarder might close a connection
There are actually three conditions that can cause the forwarder to close the network connection:
1. Read timeout. The forwarder doesn't receive acknowledgment within 300 (default) seconds. This is the condition described on this link:
`` http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Protectagainstlossofin-flightdata#Other_reasons_the_forwarder_might_close_a_connection
2. Write timeout. The forwarder is not able to finish a network write within 300 (default) seconds. The value is configurable in outputs.conf by setting writeTimeout.
3. Read/write failure. Typical causes include the indexer's machine crashing or the network going down.
4. found the tcp port was not setup in the inputs.conf file. Added the tcp entry and it is working
In all these cases, the forwarder will then attempt to open a connection to the next indexer in the load-balanced group, or to the same indexer again if load-balancing is not enabled.
... View more