Deployment Architecture

I'm seeing an error related to HTTPStreamPerf - read failed. What does this mean?

the_wolverine
Champion

I'm seeing the following errors in Splunk in my distributed search environment. What do they mean and how can I fix this?

WARN  NetUtils - Bad select_for_loop rv = -2
ERROR HTTPStreamPerf - read failed. error=-2
DispatchCommand - Read 0 results from result provider peername=hostname.domain.com at uri=https://ip_addr:8089 timetaken=30.00
0 Karma
1 Solution

the_wolverine
Champion

Most likely you're hitting a timeout on the searchhead. The "timetaken=30.00" is a clue. The default receiveTimeout value is 30 (seconds) so increasing this value may resolve the situation. The value can be changed in $SPLUNK_HOME/etc/system/local/distsearch.conf:

[distributedSearch]
receiveTimeout = 120

In Splunk version 4.1.4, we will display a banner error in UI indicating that the receiveTimeout was reached.

View solution in original post

the_wolverine
Champion

Most likely you're hitting a timeout on the searchhead. The "timetaken=30.00" is a clue. The default receiveTimeout value is 30 (seconds) so increasing this value may resolve the situation. The value can be changed in $SPLUNK_HOME/etc/system/local/distsearch.conf:

[distributedSearch]
receiveTimeout = 120

In Splunk version 4.1.4, we will display a banner error in UI indicating that the receiveTimeout was reached.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...