Splunk Dev

Multiprocessing with one connection python

jfuruness
New Member

Can two different child processes share/inherit one splunk connection, and run simultaneous searches? For some reason whenever I do this I get http: 404 not found -- unknown sid errors

0 Karma

mayurr98
Super Champion

The workaround for this
After starting search, go to Jobs page under Activity from top right hand corner. Then hit Save for the search you are running.
This error usually happens on long searches and this workaround helps.

Also you can try configure below in limits.conf

 ttl = <integer>
 * How long search artifacts should be stored on disk once completed, in
   seconds. The ttl is computed relative to the modtime of status.csv of the job
   if such file exists or the modtime of the search job's artifact directory. If
   a job is being actively viewed in the Splunk UI then the modtime of
   status.csv is constantly updated such that the reaper does not remove the job
   from underneath.
 * Defaults to 600, which is equivalent to 10 minutes.

let me know if this helps!

0 Karma

jfuruness
New Member

These searches occur automatically, so I cannot hit save as you are suggesting. Also, they only take about a minute to search, which is much less than the time to live in limits.conf. Are you sure it's not because I am running multiple searches simultaneously on the same connection (in multiple processes)? Also, do you know if it is allowed to have multiple processes inherit/share the same connection?

0 Karma

jfuruness
New Member

this is using the python sdk for splunk

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...