Splunk Search

Why is the nodejs unable to perform a number of sequential queries?

faustf
Communicator

Hi guys,

I have a nodejs service that needs to perform number of sequential queries:
e.g:

search mysearch from 01/01/2018 00:00:00 to 00:05:00
search mysearch from 01/01/2018 00:05:00 to 00:10:00
search mysearch from 01/01/2018 00:10:00 to 00:15:00
....
....
until 14/01/2018 00:00:00

The queries are very fast ( < 1s)

In my tests environment I have no problem (Splunk version 6.5.2)

In my production environment (Splunk version: 6.6.2), after some queries I receive an error:

[SPLUNKD] Unknown sid.
error: SplunkSearcher.search :: Error {"response":{"headers":{"date":"Mon, 05 Feb 2018 12:45:31 GMT","expires":"Thu, 26 Oct 1978 00:00:00 GMT","cache-control":"no-store, no-cache, must-revalidate, max-age=0","content-type":"application/json; charset=UTF-8","x-content-type-options":"nosniff","content-length":"53","vary":"Cookie, Authorization","connection":"Close","set-cookie":["splunkd_8089=jlHwfXrZZNgO.....; Path=/; Secure; HttpOnly; Max-Age=3600; Expires=Mon, 05 Feb 2018 13:45:31 GMT"],"x-frame-options":"SAMEORIGIN","server":"Splunkd"},"statusCode":404},"status":404,"data":{"messages":[{"type":"FATAL","text":"Unknown sid."}]},"error":null}

The nodejs service and the Splunk server are on the same server.

What could be the problem and how can I debug it?

thank you

0 Karma

faustf
Communicator

No one can help me?

0 Karma

paramagurukarth
Builder

Even I had similar issue when I was working with nodeJs...
But in a different environment.. CLient Browser + Server NodeJs(web component)..

In my issue the problem was not with node js... It was with the client browser.. Maximum concurrent session for a domain is 6...

May be your issue is also in the consumer part.. nodejs mostly works fine..
Try investigate on your consumer side as well...
It may queue your requests...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...