REST API connection timing out

Applicability

Universal Forwarder Splunk Enterprise Splunk Cloud

Description

When installing a new Universal Forwarder or when trying to make a connection between Universal Forwarders and Splunk getting the following errors:
 

ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:59014. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
host = idx-i-xxx.<stack>.splunkcloud.com source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkdERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:1740. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
host = idx-i-xxx.<stack>.splunkcloud.com source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkdERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:957. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
host = idx-i-xxx.<stack>.splunkcloud.com source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd

Investigation

The following WARN/INFO/ERROR messages appear in the logs by searching:

Check to see if there are any TCP related errors:
 

index=_internal host=idx* sourcetype=splunkd tcp* ERROR OR WARN

Run this for 4 hrs (Shows UI and REST requests):
 

index=_internal source=*splunkd_access.log ERROR OR WARN

Resolution

The new IP blocked, need to be whitelisted. Determined the IP address and add it to the network firewall. In case the IP address must be added to IP allow list from Cloud, this process is via self-service here Configure IP Allow List.

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release