https://community.splunk.com/t5/Monitoring-Splunk/Distributed-Search-Configuration-sendRcvTimeout/m-p/708365#M10662 <P>Hi all,</P><P>Do any of you all run into issues where the bundle replication keeps timing out and splunkd.log references increasing the sendRcvTimeout parameter, in a previous ticket with support, they supplied a Golden Configuration that says that this value should be around 180.<BR /><BR />Based on:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Distsearchconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Distsearchconf</A><BR /><BR />Under,&nbsp;'classic' REPLICATION-SPECIFIC SETTINGS<BR /><BR /></P><LI-CODE lang="markup">connectionTimeout = &lt;integer&gt; * The maximum amount of time to wait, in seconds, before a search head's initial connection to a peer times out. * Default: 60 sendRcvTimeout = &lt;integer&gt; * The maximum amount of time to wait, in seconds, when a search head is sending a full replication to a peer. * Default: 60</LI-CODE><P>&nbsp;</P><P>Should these two values be adjusted and kept in-sync?<BR /><BR />I am considering adding another 30 seconds to each.</P><P>Or, if there is something else I should be verifying first, it would be helpful to get some direction here.</P> Thu, 09 Jan 2025 15:47:39 GMT JohnEGones 2025-01-09T15:47:39Z https://community.splunk.com/t5/Monitoring-Splunk/Distributed-Search-Configuration-sendRcvTimeout/m-p/708365#M10662 <P>Hi all,</P><P>Do any of you all run into issues where the bundle replication keeps timing out and splunkd.log references increasing the sendRcvTimeout parameter, in a previous ticket with support, they supplied a Golden Configuration that says that this value should be around 180.<BR /><BR />Based on:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Distsearchconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Distsearchconf</A><BR /><BR />Under,&nbsp;'classic' REPLICATION-SPECIFIC SETTINGS<BR /><BR /></P><LI-CODE lang="markup">connectionTimeout = &lt;integer&gt; * The maximum amount of time to wait, in seconds, before a search head's initial connection to a peer times out. * Default: 60 sendRcvTimeout = &lt;integer&gt; * The maximum amount of time to wait, in seconds, when a search head is sending a full replication to a peer. * Default: 60</LI-CODE><P>&nbsp;</P><P>Should these two values be adjusted and kept in-sync?<BR /><BR />I am considering adding another 30 seconds to each.</P><P>Or, if there is something else I should be verifying first, it would be helpful to get some direction here.</P> Thu, 09 Jan 2025 15:47:39 GMT https://community.splunk.com/t5/Monitoring-Splunk/Distributed-Search-Configuration-sendRcvTimeout/m-p/708365#M10662 JohnEGones 2025-01-09T15:47:39Z https://community.splunk.com/t5/Monitoring-Splunk/Distributed-Search-Configuration-sendRcvTimeout/m-p/708369#M10663 <P>Those two timeouts do not need to match.&nbsp; Sixty seconds should be more than enough time to establish a connection.&nbsp; More may be needed to send a bundle, however.</P><P>The bigger question is *why* is the delivery timing out?&nbsp; Perhaps the bundle is too large.&nbsp; If so, you should work on making it smaller (look at large lookup files first).</P> Thu, 09 Jan 2025 16:05:22 GMT https://community.splunk.com/t5/Monitoring-Splunk/Distributed-Search-Configuration-sendRcvTimeout/m-p/708369#M10663 richgalloway 2025-01-09T16:05:22Z