Getting Data In

When I add data in Splunk, why does "Preview data before indexing" result in error "The read operation timed out"?

criferr
New Member

HI,

Since yesterday, when I add data into Splunk and choose "Preview data before indexing" this error message appears:

Splunkd daemon is not responding: ('Error connecting to /servicesNS/-/-/indexing/preview: The read operation timed out',)

Before yesterday the preview worked on the same data.

What happened?

0 Karma

criferr
New Member

First solution:
1- copy web.conf from C:\Program Files\Splunk\etc\system\default to C:\Program Files\Splunk\etc\system\local
2- increase this attribute in the file

                               splunkdConnectionTimeout = (default 30 secs) 

3-save and restart splunk.

Now it works!

But I don't understand why that error occours..

0 Karma

criferr
New Member

And today don't work again!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...