topic Re: How do I change the REST API execution timeout? in Splunk Search

How do I change the REST API execution timeout?

thelucas — Thu, 11 Jan 2018 16:47:16 GMT

I am trying to setup the DUO Splunk Connector and am getting the following error in Splunk Web upon submitting the configuration form:

Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: ('The read operation timed out',)",)

I have verified my Key and Host settings.

Splunkd.log:

01-11-2018 09:32:31.789 -0700 INFO  ModularInputs - <stderr> Argument validation for scheme=duo_input:  Validating input
01-11-2018 09:33:01.751 -0700 ERROR ModularInputs - Argument validation for scheme=duo_input: killing process, because executing it took too long (over 30000 msecs).
01-11-2018 09:33:01.753 -0700 INFO  ModularInputs - Argument validation for scheme=duo_input: script running failed (killed by signal 9: Killed).
01-11-2018 09:33:01.754 -0700 WARN  HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: Broken pipe

I believe that I need to raise a timeout setting, but my searches have turned up null when looking for any sort of timeout setting that the Splunk REST API references.

Re: How do I change the REST API execution timeout?

valiquet — Fri, 27 Oct 2023 15:54:41 GMT

|REST timeout=33333 (in seconds)

Re: How do I change the REST API execution timeout?

thelucas — Fri, 09 Mar 2018 16:56:32 GMT

In what configuration file?

I ran:

find /opt/splunk/ -name "*.conf" -print | xargs grep "REST timeout"

and

grep -rnw '/opt/splunk/' -e 'REST timeout'

And didn't find it.

Re: How do I change the REST API execution timeout?

valiquet — Sat, 10 Mar 2018 05:05:26 GMT

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Rest

Re: How do I change the REST API execution timeout?

thelucas — Mon, 12 Mar 2018 15:51:41 GMT

Hi folks,

In this particular case I had to edit:
/opt/splunk/etc/system/local/web.conf

adding the stanza:

splunkdConnectionTimeout = 120

which is defaulted to 30 seconds

Re: How do I change the REST API execution timeout?

wrangler2x — Tue, 27 Mar 2018 19:44:04 GMT

I set this to 120 and verified it with this rest:

| rest /servicesNS/-/-/configs/conf-web/settings

after restarting splunkweb. however, I get the same message in ~/var/log/splunk/splunkd.log which is that it got killed after 30000 msecs (30 seconds).

Re: How do I change the REST API execution timeout?

thelucas — Tue, 27 Mar 2018 20:03:39 GMT

Did you restart splunkd (i.e. not just splunkweb)?

Re: How do I change the REST API execution timeout?

wrangler2x — Tue, 27 Mar 2018 20:49:40 GMT

Yes, I did. Also I verified the settings using the rest you show above.