IronPort WSA dashboard sub-charts fail to render and instead show time-out errors

[egmartin]

How do you prevent read time out errors from occurring in the primary dashboard titled ‘IronPort Web Security Overview’? Instead of rendering the pretty collection of charts shown on the main page of the Cisco IronPort Web Security Appliance, each chart area of the dashboard renders “Results Error: 500 – Splunkd daemon is not responding: (‘The read operation timed out’.)”. Expected dashboard sub-charts include those rendered for the self-installed Cisco saved reports, i.e. ‘Cisco WSA – Security – DataCube’, ‘Cisco WSA – Top Websites’, ‘Cisco WSA – Web Threats Detected’, etc.

Concerning my Splunk Enterprise configuration – I installed the Cisco IronPort Web Security Appliance (file name: Splunk_CiscoIronportWebSecurity.tar.gz’) as instructed per the readme file using the Splunk’s ‘install from file’ feature (using the web menu: Manager > Apps > Install app from file). The web security appliance works well on my configuration when auto-parsing the Cisco fields from the IronPort log data. Splunk consumes my IronPort data when tagged as sourcetype=cisco_wsa_squid, and when using the Splunk search bar features, I can fetch and extract IronPort data based off the full set of auto-parsed Cisco fields, e.g. x_webcat_code_full, x_wbrs_score, etc. Also, when invoking individual saved reports associated with the dashboard (and installed by the Cisco Add-on), they also run without error, albeit requiring in some cases in excess of 9 minutes to complete.

Can the saved searches be cached so that when the dashboard attempts to invoke them, they will not time out? Or maybe the queries for the saved searches require modification concerning the time range so that the queries can complete on time.

[egmartin · Accepted solution]

An answer on a post similar to this issue solved my problem. You simply need to stop the service splunkweb, edit the file {$SPLUNK_HOME}\Python-2.7\Lib\site-packages\splunk\rest\__init__.py, set the value for SPLUNKD_CONNECTION_TIMEOUT = 300 instead of 30, save this file, and then start splunkweb again. Just for grins I restarted splunkd. The charts render as expected.