topic Re: Recommendations for Splunkd daemon error? in Splunk Enterprise

Recommendations for Splunkd daemon error?

JohnHC — Tue, 14 Feb 2023 19:58:33 GMT

All,

I am having an issue with splunk and uploading Pcap files to the server we are running on prem. When I attempt to upload a Pcap file via the data inputs option I receive the following error.

Encountered the following error while trying to save: Splunkd daemon is not responding: ('Error connecting to /servicesNS/admin/launcher/data/inputs/upload_pcap: The read operation timed out',)

My thinking is it could be too big and is timing out the daemon. If that is the case can this timeout be edited?

Pcap files are in the 139MB size range.

Thank you for any recommendations or insight.

Re: Recommendations for Splunkd daemon error?

scelikok — Wed, 15 Feb 2023 05:16:31 GMT

Hi @JohnHC,

If you have access to command line you can try cli commands;

[root@myserver bin] ./streamfwd -r my.pcap

https://docs.splunk.com/Documentation/StreamApp/8.1.0/DeployStreamApp/streamfwdcommandlineoptions#Read_PCAP_files

Re: Recommendations for Splunkd daemon error?

JohnHC — Wed, 15 Feb 2023 19:41:11 GMT

That command is not an issue. We are attempting to input the pcap file into the input data field so other users can perform searches from the Splunk search GUI. We are attempting to upload the files here and are getting the error.

Re: Recommendations for Splunkd daemon error?

scelikok — Thu, 16 Feb 2023 08:27:26 GMT

Hi @JohnHC,

That cli command is the same function as uploading using GUI. You can set index and sourcetype if you will.

As a sample;

[root@myserver bin] ./streamfwd -r my.pcap --index pcap_index