Rewindex

ChangesCriblSplunk Single Instance and LB Unexpectedly Closing Connections

Cribl: Critical incident: Splunk Single Instance and LB Unexpectedly Closing Connections

Major incidentcritical (vendor)Changed Detected stspg.io (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Incident page: the full timeline of updates

What changed

Struck in red is what Cribl removed; blue is what they added. Muted text is unchanged context.

AddedTitle#1
Before: not present
After: Splunk Single Instance and LB Unexpectedly Closing Connections
AddedImpact#2
Before: not present
After: critical
AddedStatus#3
Before: not present
After: resolved
AddedStart time#4
Before: not present
After: 2024-08-15 01:31 UTC
AddedResolved time#5
Before: not present
After: 2024-08-15 15:56 UTC
AddedAffected components#6
Before: not present
After: AWS US East 1 (Virginia) - Data Plane (Workers), Data Plane (Workers)
AddedUpdateidentified#7
Before: not present
After: The issue has been identified and a fix is being implemented.
AddedUpdateidentified#8
Before: not present
After: Status: We have identified an issue in Stream version 4.8.0, where Splunk Single Instance and Splunk Load Balanced Destinations mistakenly detected that the downstream Splunk instance is frequently shutting down. Customer Impact: Stream and Edge Nodes are not able to connect to the Splunk destination. This incident affects: Cribl.Cloud Stream and Edge. Customer Splunk destination data streams are affected by this incident. Next Update: We will provide updates every 60 minutes. Cribl Support is available to answer questions via email at support@cribl.io. Thank You for being a Cribl.Cloud customer.
AddedUpdateidentified#9
Before: not present
After: Status: We're continuing to review the issue and are working to address it as soon as possible. To mitigate the issue in the meantime, set S2S version to v4. Customer Impact: Stream and Edge Nodes are not able to connect to the Splunk destination. This incident affects: Cribl.Cloud Stream and Edge. Customer Splunk destination data streams are affected by this incident. Next Update: We will provide an update tomorrow morning at 8 AM EDT (Aug 15). Cribl Support is available to answer questions via email at support@cribl.io.
AddedUpdateidentified#10
Before: not present
After: Status: We have identified a fix and plan on making it available today, within the next few hours. To mitigate the issue in the meantime, set S2S version to v4. Customer Impact: Stream and Edge Nodes are not able to connect to the Splunk destination. This incident affects: Cribl.Cloud Stream and Edge. Customer Splunk destination data streams are affected by this incident. Next Update: We will provide updates every 60 mins. Cribl Support is available to answer questions via email at support@cribl.io.
AddedUpdateidentified#11
Before: not present
After: Status: We have started to roll out the fix to addresss the issue. Customer Impact: Stream and Edge Nodes are not able to connect to the Splunk destination. This incident affects: Cribl.Cloud Stream and Edge. Customer Splunk destination data streams are affected by this incident. Next Update: We will provide updates every 60 mins. Cribl Support is available to answer questions via email at support@cribl.io.
AddedUpdateidentified#12
Before: not present
After: Status: We're continuing to roll out the fix to addresss the issue. Customer Impact: Stream and Edge Nodes are not able to connect to the Splunk destination. This incident affects: Cribl.Cloud Stream and Edge. Customer Splunk destination data streams are affected by this incident. Next Update: We will provide updates every 60 mins. Cribl Support is available to answer questions via email at support@cribl.io.
AddedUpdateresolved#13
Before: not present
After: This incident has been resolved.

First version of this incident archived by Rewindex. View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.

How the archive is checked, and what it cannot prove.

Rewindex captured this after the last checkpoint; the next run (00:41 UTC) commits it.

This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.

History of this incident

Thursday, August 15, 2024

1 incident change

All Cribl changesCribl profileMarkdownJSON