https://community.splunk.com/t5/Deployment-Architecture/How-do-I-determine-the-appropriate-timeout-value-for-distributed/m-p/48725#M1493 <P>Some searches are going back to "ALL TIME" so I'd imagine there is an appropriate time to change the default. Depending on one's environment that could go back quite a few months. So if the default is 600 seconds I would imagine changing this to a few more minutes should be safe, right? If not, what's the repercussions?</P> Wed, 09 Aug 2017 19:18:36 GMT rstrong30 2017-08-09T19:18:36Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-determine-the-appropriate-timeout-value-for-distributed/m-p/48722#M1490 <P>I see timeouts with distributed search and currently have <CODE>receiveTimeout</CODE> set to 300. What metric(s) can I use to determine the what should be the correct value this setting in order to avoid timeouts?</P> Wed, 23 Feb 2011 02:54:16 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-determine-the-appropriate-timeout-value-for-distributed/m-p/48722#M1490 matt 2011-02-23T02:54:16Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-determine-the-appropriate-timeout-value-for-distributed/m-p/48723#M1491 <P>I also need to find this out</P> Thu, 17 May 2012 16:32:53 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-determine-the-appropriate-timeout-value-for-distributed/m-p/48723#M1491 jdunlea_splunk 2012-05-17T16:32:53Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-determine-the-appropriate-timeout-value-for-distributed/m-p/48724#M1492 <P>The current default value for this parameter is 600 seconds and there really shouldn't be any good reason to proactively increase or lower it.</P> <P>If while searching, you see errors reporting search peer timeouts, the right question to ask is "Why are search peers taking more than 600 seconds to respond?".</P> <UL> <LI><P>The first place to look for a possible explanation is the search.log file created by the search process on the search-head, in <CODE>$SPLUNK_HOME/var/run/splunk/dispatch/{SID}</CODE> where <CODE>{SID}</CODE> is the ID of the search.</P></LI> <LI><P>Another good place to look is the search.log file created by the search process on the <STRONG>remote peer</STRONG>, in <CODE>$SPLUNK_HOME/var/run/splunk/dispatch/remote_{SH-ServerName}_{SID}</CODE> where <CODE>{SH-ServerName}</CODE> is the ServerName as set in server.conf for the search-head that dispatched the search, and <CODE>{SID}</CODE> is the ID of the search.</P> <UL> <LI>As peer timeouts are often linked with network quality issues, it is also a good idea to check that there are no issues with the network link between the search-head and the affected peer(s).</LI> </UL></LI> </UL> Wed, 31 Oct 2012 03:03:13 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-determine-the-appropriate-timeout-value-for-distributed/m-p/48724#M1492 hexx 2012-10-31T03:03:13Z https://community.splunk.com/t5/Deployment-Architecture/How-do-I-determine-the-appropriate-timeout-value-for-distributed/m-p/48725#M1493 <P>Some searches are going back to "ALL TIME" so I'd imagine there is an appropriate time to change the default. Depending on one's environment that could go back quite a few months. So if the default is 600 seconds I would imagine changing this to a few more minutes should be safe, right? If not, what's the repercussions?</P> Wed, 09 Aug 2017 19:18:36 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-I-determine-the-appropriate-timeout-value-for-distributed/m-p/48725#M1493 rstrong30 2017-08-09T19:18:36Z