HTTP client error=Read Timeout while accessing server=http://127.0.0.1:8065 - Splunk Add-on Builder

edoardo_vicendo — Tue, 16 Jan 2024 16:45:39 GMT

Hello,

I am adding an Alert Action with Splunk Add-on Builder, but when I click “save” it basically goes in timeout.

01-16-2024 17:01:31.340 +0100 ERROR HttpClientRequest [24831 TcpChannelThread] - HTTP client error=Read Timeout while accessing server=http://127.0.0.1:8065 for request=http://127.0.0.1:8065/en-US/custom/splunk_app_addon-builder/app_edit_modularalert/add_modular_alert.

In the meanwhile if I open a new tab on the browser, whichever page I request falls in timeout as well.

01-16-2024 17:02:18.114 +0100 ERROR HttpClientRequest [7954 TcpChannelThread] - HTTP client error=Read Timeout while accessing server=http://127.0.0.1:8065 for request=http://127.0.0.1:8065/en-US.

Looking into the /opt/splunk/etc/apps folder it seems my app stuck in TA-splunk-myapp_temp_output folder meanwhile is saving.

splunk@SearchHead:~/etc/apps > ls -latr drwxrwxrwx 10 splunk splunk 4096 Jan 15 16:02 TA-splunk-myapp … drwxrwxrwx 3 splunk splunk 4096 Jan 16 16:53 TA-splunk-myapp_temp_output

I also tried to:

cancel the TA-splunk-myapp_temp_output folder, restart Splunk and try again saving.
increase performance from 16CPU/32GB to 32CPU/64GB

but I have the same issue.

It seems that the timeout comes from the “appserver” that runs on port 8065.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Webconf

appServerPorts = <positive integer>[, <positive integer>, <positive integer> ...] * Port number(s) for the python-based application server to listen on. This port is bound only on the loopback interface -- it is not exposed to the network at large. * Generally, you should only set one port number here. For most deployments a single application server won't be a performance bottleneck. However you can provide a comma-separated list of port numbers here and splunkd will start a load-balanced application server on each one. * At one time, setting this to zero indicated that the web service should be run in a legacy mode as a separate service, but as of Splunk 8.0 this is no longer supported. * Default: 8065

I am thinking about:

Put the logs in DEBUG
Adding other ports to start load-balanced application server

Any suggestion is really appreciated.

Thanks a lot,

Edoardo

Re: HTTP client error=Read Timeout while accessing server=http://127.0.0.1:8065 - Splunk Add-on Builder

edoardo_vicendo — Wed, 17 Jan 2024 16:34:03 GMT

For the time being I have solved the issue saving the code one piece at a time.

Saving the 200 lines of code in one shot was generating the problem...

Restarting Splunk in DEBUG mode can point in the right direction to understand the root cause, but the amount of messages is really huge.

topic HTTP client error=Read Timeout while accessing server=http://127.0.0.1:8065 - Splunk Add-on Builder in Splunk Enterprise

HTTP client error=Read Timeout while accessing server=http://127.0.0.1:8065 - Splunk Add-on Builder

Re: HTTP client error=Read Timeout while accessing server=http://127.0.0.1:8065 - Splunk Add-on Builder