- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How do I change the REST API execution timeout?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to setup the DUO Splunk Connector and am getting the following error in Splunk Web upon submitting the configuration form:
Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: ('The read operation timed out',)",)
I have verified my Key and Host settings.
Splunkd.log:
01-11-2018 09:32:31.789 -0700 INFO ModularInputs - <stderr> Argument validation for scheme=duo_input: Validating input
01-11-2018 09:33:01.751 -0700 ERROR ModularInputs - Argument validation for scheme=duo_input: killing process, because executing it took too long (over 30000 msecs).
01-11-2018 09:33:01.753 -0700 INFO ModularInputs - Argument validation for scheme=duo_input: script running failed (killed by signal 9: Killed).
01-11-2018 09:33:01.754 -0700 WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: Broken pipe
I believe that I need to raise a timeout setting, but my searches have turned up null when looking for any sort of timeout setting that the Splunk REST API references.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi folks,
In this particular case I had to edit:
/opt/splunk/etc/system/local/web.conf
adding the stanza:
splunkdConnectionTimeout = 120
which is defaulted to 30 seconds
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi folks,
In this particular case I had to edit:
/opt/splunk/etc/system/local/web.conf
adding the stanza:
splunkdConnectionTimeout = 120
which is defaulted to 30 seconds
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I set this to 120 and verified it with this rest:
| rest /servicesNS/-/-/configs/conf-web/settings
after restarting splunkweb. however, I get the same message in ~/var/log/splunk/splunkd.log which is that it got killed after 30000 msecs (30 seconds).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you restart splunkd (i.e. not just splunkweb)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I did. Also I verified the settings using the rest you show above.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
|REST timeout=33333 (in seconds)- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In what configuration file?
I ran:
find /opt/splunk/ -name "*.conf" -print | xargs grep "REST timeout"
and
grep -rnw '/opt/splunk/' -e 'REST timeout'
And didn't find it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Custom Visualizations App End of Life
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
