All Apps and Add-ons

SOS 3.2 on Splunk 6.2 loggs HttpListener Exception

dlpco
Path Finder

When clicking on items like Resource CPU/Memory Usage, Data Inputs Overview and the like gives the following error:

ERROR HttpListener - Exception while processing request from 192.168.xxx.xxx for /en-US/module/system/Splunk.Module.SimpleResultsTable/render?count=20&offset=0&max_lines=10&sid=1415262567.45&entity_name=results&display_row_numbers=on&mark_interactive=1&client_app=sos&_=1415262570592: Connection closed by peer

and sometimes it is followed by:

WARN HttpListener - Socket error from 192.168.1.214 while accessing /en-US/module/system/Splunk.Module.SimpleResultsTable/render: Broken pipe

Just going to Deployment Topology (not clicking on any icon) gives:

WARN HandleJobsDataProvider - Requested argument count (100000) exceeds the maxresultrows limit specified under restapi stanza in limits.conf (50000)

Any ideas???

pkeller
Contributor

I just started seeing the same error this morning. Two panels of a dashboard that typically display two charts ( one a column, the other a line ), now only have the title.

Happens in Chrome ... I tried in Firefox and was greeted with this: (where the charts should be rendering)

alt text

0 Karma

pkeller
Contributor

Ok ... I updated both Chrome and Firefox this morning and the problem has vanished.

0 Karma

Chubbybunny
Splunk Employee
Splunk Employee

bump. seeing the same in our environment.

0 Karma

dlpco
Path Finder

This seems to be an IE 11 issue. It fails with IE 11 rather in compatibility mode or not. If I use Firefox (33.0.2) from the same machine, the failures are not seen. I am unsure rather it is an issue with SoS (3.2) or SideView Utils (3.3). Any thoughts???

sideview
SplunkTrust
SplunkTrust

I think it's a Splunk issue actually, something new in 6.2. Because I'm chasing another set of problems also caused by socket errors in HttpListener, also on Splunk 6.2. The ones I have seen are on windows so they present differently (Winsock errors for one thing), but they seem to represent new behavior as of 6.2. And as in this case the place where things are blowing up the worst is when the python controller in Splunk's own SimpleResultTable module tries to use the REST api to get its search results.

dlpco
Path Finder

sideview....

You found anything of interest yet?

0 Karma

dlpco
Path Finder

It is strange though that the errors go away if I use Firefox rather than IE 11. Splunk is running in a Linux virtual machine (like the previous versions) so you are correct that it is not Windows. I am connecting to Splunk from a Windows machine. I still am trying to get my head around Firefox working fine and IE 11 not. Going to mess around some more with IE settings to see if I can find something.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...