# Cribl: Critical incident: Splunk Single Instance and LB Unexpectedly Closing Connections

**Summary:** _summary pending_
- Kind: Major incident · Label: critical (vendor)
- Changed: 2024-08-15 01:31 UTC · Detected: 2026-10-19 18:33 UTC
- [Source: https://stspg.io/my8t9mp4gnzm](https://stspg.io/my8t9mp4gnzm)
- [Company: Cribl](https://rewindex.com/company/cribl.md)
- Versions: before (none: first archived) → after incident\_version:731/7gh08jrncpz8@5b5bc738205a
- Change 1 of 1 for this incident

Incident page (full timeline): [Splunk Single Instance and LB Unexpectedly Closing Connections](https://rewindex.com/company/cribl/incidents/7gh08jrncpz8.md)
## What changed

**1. Added: Title**

```diff
+ Splunk Single Instance and LB Unexpectedly Closing Connections
```

**2. Added: Impact**

```diff
+ critical
```

**3. Added: Status**

```diff
+ resolved
```

**4. Added: Start time**

```diff
+ 2024-08-15 01:31 UTC
```

**5. Added: Resolved time**

```diff
+ 2024-08-15 15:56 UTC
```

**6. Added: Affected components**

```diff
+ AWS US East 1 (Virginia) - Data Plane (Workers), Data Plane (Workers)
```

**7. Added: Update** (identified) · 2024-08-15 01:31 UTC

```diff
+ The issue has been identified and a fix is being implemented.
```

**8. Added: Update** (identified) · 2024-08-15 01:33 UTC

```diff
+ Status: We have identified an issue in Stream version 4.8.0, where Splunk Single Instance and Splunk Load Balanced Destinations mistakenly detected that the downstream Splunk instance is frequently shutting down. Customer Impact: Stream and Edge Nodes are not able to connect to the Splunk destination. This incident affects: Cribl.Cloud Stream and Edge. Customer Splunk destination data streams are affected by this incident. Next Update: We will provide updates every 60 minutes. Cribl Support is available to answer questions via email at support@cribl.io. Thank You for being a Cribl.Cloud customer.
```

**9. Added: Update** (identified) · 2024-08-15 03:25 UTC

```diff
+ Status: We're continuing to review the issue and are working to address it as soon as possible. To mitigate the issue in the meantime, set S2S version to v4. Customer Impact: Stream and Edge Nodes are not able to connect to the Splunk destination. This incident affects: Cribl.Cloud Stream and Edge. Customer Splunk destination data streams are affected by this incident. Next Update: We will provide an update tomorrow morning at 8 AM EDT (Aug 15). Cribl Support is available to answer questions via email at support@cribl.io.
```

**10. Added: Update** (identified) · 2024-08-15 12:16 UTC

```diff
+ Status: We have identified a fix and plan on making it available today, within the next few hours. To mitigate the issue in the meantime, set S2S version to v4. Customer Impact: Stream and Edge Nodes are not able to connect to the Splunk destination. This incident affects: Cribl.Cloud Stream and Edge. Customer Splunk destination data streams are affected by this incident. Next Update: We will provide updates every 60 mins. Cribl Support is available to answer questions via email at support@cribl.io.
```

**11. Added: Update** (identified) · 2024-08-15 13:20 UTC

```diff
+ Status: We have started to roll out the fix to addresss the issue. Customer Impact: Stream and Edge Nodes are not able to connect to the Splunk destination. This incident affects: Cribl.Cloud Stream and Edge. Customer Splunk destination data streams are affected by this incident. Next Update: We will provide updates every 60 mins. Cribl Support is available to answer questions via email at support@cribl.io.
```

**12. Added: Update** (identified) · 2024-08-15 15:12 UTC

```diff
+ Status: We're continuing to roll out the fix to addresss the issue. Customer Impact: Stream and Edge Nodes are not able to connect to the Splunk destination. This incident affects: Cribl.Cloud Stream and Edge. Customer Splunk destination data streams are affected by this incident. Next Update: We will provide updates every 60 mins. Cribl Support is available to answer questions via email at support@cribl.io.
```

**13. Added: Update** (resolved) · 2024-08-15 15:56 UTC

```diff
+ This incident has been resolved.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2024-08-15 01:31 UTC | Critical incident: Splunk Single Instance and LB Unexpectedly Closing Connections (this change) | critical |

All Cribl changes: [timeline](https://rewindex.com/company/cribl/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/i2be205eb483537 · Markdown: https://rewindex.com/change/i2be205eb483537.md · JSON: https://rewindex.com/api/v1/changes/i2be205eb483537 · Generated 2026-10-20T00:48:31.775Z