Splunk Times out on large Data Export of Table

itsmevic — Mon, 03 Aug 2020 21:06:43 GMT

Hello, Splunk is timing out after I try and use the export feature in UI. There is quite a bit of data that needs to be exported. Is there a way to keep it from timing out?

Re: Splunk Times out on large Data Export of Table

The_Simko — Tue, 04 Aug 2020 01:20:27 GMT

This is where the session timeout field comes into play. Settings > Server Settings > General Settings. Then in the Splunk Web section change the Session Timeout.

Now, if that still doesn't work you always have some options like using |outputlookup to write the data as a .csv and then pick it up. Obviously it only works for certain types of data, and requires you to be able to access the CLI to get a copy of the data, but it may work for some uses.

Another thing to try would be use to REST API to export, like shown in this post from Discovered Intelligence: https://discoveredintelligence.ca/get-data-out-of-splunk/#:~:text=A%20user%20can%20call%20the,on%2Dpremise%20and%20cloud%20deployments.

topic Splunk Times out on large Data Export of Table in Splunk Enterprise

Splunk Times out on large Data Export of Table

Re: Splunk Times out on large Data Export of Table