Not able to diable alert using curl command

[akanksha01]

Hi Team,

I am using following CURL command

curl -k -u admin:password -X POST https://<host>:<port>/servicesNS/akanksha_goel1/search/saved/searches/Clickstream-Microsurvey-Failure-Alert-Rule-Dev -d "disabled=1" --max-time 60 -H "Content-Type: application/x-www-form-urlencoded"

But I am getting error as
Error: read ECONNRESET

kindly help us resolve the issue!

[PickleRick]

Connection reset means that the other end either completely refused to connect or for some reason decided that the connection is erroneous and closed it abruptly.

It is fairly uncommon for a HTTP server to properly respond to a request and close the connection abruptly like that (although it's not unheard of) - typically the server, even if the HTTP response contains an errorcode, closes the connection gracefully. Also in such case you'd see some response.

So it's more probable that either the TLS handshake is terminated due to some error in connection negotiation or there is some network-level problem or you are simply connecting to a wrong port.

The easiest way to troubleshoot would be to check network traffic on both ends during such curl request.

[livehybrid]

Hi @akanksha01 

The ECONNRESET error indicates that the TCP connection was abruptly closed by the Splunk server or an intermediary network device (like a firewall or load balancer) before the request could be fully processed or the response sent. The curl command syntax itself for disabling the saved search appears correct.

Troubleshooting steps:

1. Verify Network Connectivity: Ensure the IP and port (typically 8089 for the Splunk management port) are correct and reachable from the machine running the curl command. Check for firewalls or network ACLs that might be blocking or resetting the connection at either source or destination.
2. Check Splunk Server Status: Ensure the Splunk instance is running and responsive, are you able to reach the instance using netcat from your source?
3. Examine Splunk Logs: Check the$SPLUNK_HOME/var/log/splunk/splunkd.log on the Splunk server for any errors occurring around the time you ran the curl command. This might provide clues about why the server closed the connection.

1. Check Intermediary Devices: If you are connecting through a load balancer or proxy, check its logs and configuration. It might have shorter timeouts or specific rules causing the connection reset.
2. Simplify the Request: Try the request without --max-time 60 initially to rule out timeout interactions, although disabling an alert should be very fast. You could also apply -v to provide a more verbose output.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing