topic When I add data in Splunk, why does "Preview data before indexing" result in error "The read operation timed out"? in Getting Data In

When I add data in Splunk, why does "Preview data before indexing" result in error "The read operation timed out"?

criferr — Tue, 22 Nov 2016 17:13:09 GMT

HI,

Since yesterday, when I add data into Splunk and choose "Preview data before indexing" this error message appears:

Splunkd daemon is not responding: ('Error connecting to /servicesNS/-/-/indexing/preview: The read operation timed out',)

Before yesterday the preview worked on the same data.

What happened?

Re: When I add data in Splunk, why does "Preview data before indexing" result in error "The read operation timed out"?

criferr — Tue, 22 Nov 2016 18:30:15 GMT

First solution:
1- copy web.conf from C:\Program Files\Splunk\etc\system\default to C:\Program Files\Splunk\etc\system\local
2- increase this attribute in the file

                               splunkdConnectionTimeout = (default 30 secs)

3-save and restart splunk.

Now it works!

But I don't understand why that error occours..

Re: When I add data in Splunk, why does "Preview data before indexing" result in error "The read operation timed out"?

criferr — Wed, 23 Nov 2016 15:59:21 GMT

And today don't work again!