topic Re: Direct REST API /services/saved/searches timeout in Splunk Cloud Platform

Direct REST API /services/saved/searches timeout

daniedoe — Thu, 20 Feb 2025 18:08:23 GMT

I want to know if there is any server-side timeout that a response must complete in for a call to the endpoint Get /services/saved/searches. Does Splunk have a default timeout for handling these API calls?

Re: Direct REST API /services/saved/searches timeout

Cievo — Thu, 20 Feb 2025 19:18:44 GMT

Hello

Maybe you need to edit /opt/splunk/etc/system/local/web.conf

adding the stanza:

splunkdConnectionTimeout = 120

More HERE.

Re: Direct REST API /services/saved/searches timeout

daniedoe — Thu, 20 Feb 2025 21:22:15 GMT

I believe this only applies to how Splunk Web (UI) interacts with splunkd not how direct REST API calls are made to splunkd on port 8089.

I am trying to determine if I should just use a client side timeout for the endpoint call.

Re: Direct REST API /services/saved/searches timeout

kiran_panchavat — Fri, 21 Feb 2025 06:52:24 GMT

@daniedoe

You're correct. The splunkdConnectionTimeout setting in web.conf primarily affects how Splunk Web (UI) interacts with splunkd. For direct REST API calls made to splunkd on port 8089, the timeout behavior can be different.

If you need more detailed information, you can refer to the Splunk REST API

Solved: How do I change the REST API execution timeout? - Splunk Community

Access endpoint descriptions - Splunk Documentation

Re: Direct REST API /services/saved/searches timeout

daniedoe — Fri, 21 Feb 2025 13:32:00 GMT

I appreciate the reply, but this is why I am asking the question I cannot find any information about a timeout in the documentation for this.

If there is no timeout that is fine, just want to know.