Hi, we use Cribl 4.0.3 in our environment and have currently issues within a stable connection to Splunk Agents within version 9.0.2.
It seems like, that the connection is up and dropping after some minutes.
Could it be a possible error with the s2s protocol?
In Sources config we can use v4 (beta). Does it work properly? Splunk says in their release document that v3 will be deprecated soon.
Hi Brenny, I would kindly ask that you open a support case for our engineers to troubleshoot the issue.
Hi, are some additional infos.
On Splunk Forwarder we only get the following ERROR messages: unexpected event ID xxx
May this help?
#####Update
It looks like we made it.