Splunk Add-on for Zenoss / TA-zenoss- Why am I receiving this error?

[drejoe]

Hi,

When trying to config the inputs via the GUI I keeps getting the following error after adding all the information (press Next):

Encountered the following error while trying to save: Splunkd daemon is not responding: ('Error connecting to /servicesNS/admin/TA-zenoss/data/inputs/zenoss_events: The read operation timed out',)

While I'm running on a VM, I just added more vCores and Memory - but still gets the same error.

It's the current newest version 2.1.0 of the TA and Splunk version 8.2.6 on Ubuntu 18.04LTS.

Any help?

Thanks //T

@epescio_splunk @shaskell_splunk 

[epescio_splunk]

Hi @drejoe ,

Please check the _internal index around the time of the error. Is there any other relevant log message?

[drejoe]

Hi again @epescio_splunk 

Just ran the setup process again and gets this in splunkd:

06-02-2022 14:21:14.554 +0200 WARN HttpListener [239862 HttpDedicatedIoThread-7] - Socket error from 127.0.0.1:36934 while accessing /servicesNS/admin/search/data/inputs/zenoss_events: Broken pipe
06-02-2022 14:21:14.528 +0200 ERROR ModularInputs [2321750 TcpChannelThread] - Argument validation for scheme=zenoss_events: killing process, because executing it took too long (over 30000 msecs).

Other error in the timezone:

06-02-2022 14:21:12.051 +0200 ERROR ChunkedExternProcessor [2355645 ChunkedExternProcessorStderrLogger] - stderr: BrokenPipeError: [Errno 32] Broken pipe
06-02-2022 14:21:12.051 +0200 ERROR ChunkedExternProcessor [2355645 ChunkedExternProcessorStderrLogger] - stderr: Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='UTF-8'>

Cheers //T

[epescio_splunk · Accepted solution]

Hi @drejoe ,

Unfortunately I cannot reproduce this error, but I would recommend you to:

• Carefully check hardware spec requirements (https://docs.splunk.com/Documentation/Splunk/8.2.6/Installation/SystemRequirements#Recommended_hardw... ) - Please verify if there are any peaks on IOPs especially and eventually adjust your configuration
• Please verify the connectivity from the Splunk VM to your Zenoss instance with a simple curl command - Network latency? Firewall?