We found the following message in splunkd.log in Universal Forwarder 7.0.2. The UF forwards logs to Splunk Cloud. It occurs infrequently, but some log files were not indexed while UF outputs this error message. I don't know the causal correlation between lack of indexing and the SSL error but, I was wondering the root cause and how to fix it.
```03-08-2018 08:02:18.138 INFO TcpOutputProc - Connection to :9997 closed. default Error in SSL_read = 104, SSL Error = error:00000000:lib(0):func(0):reason(0)```
↧