Deployment Architecture

I'm seeing an error related to HTTPStreamPerf - read failed. What does this mean?

the_wolverine
Champion

I'm seeing the following errors in Splunk in my distributed search environment. What do they mean and how can I fix this?

WARN  NetUtils - Bad select_for_loop rv = -2
ERROR HTTPStreamPerf - read failed. error=-2
DispatchCommand - Read 0 results from result provider peername=hostname.domain.com at uri=https://ip_addr:8089 timetaken=30.00
0 Karma
1 Solution

the_wolverine
Champion

Most likely you're hitting a timeout on the searchhead. The "timetaken=30.00" is a clue. The default receiveTimeout value is 30 (seconds) so increasing this value may resolve the situation. The value can be changed in $SPLUNK_HOME/etc/system/local/distsearch.conf:

[distributedSearch]
receiveTimeout = 120

In Splunk version 4.1.4, we will display a banner error in UI indicating that the receiveTimeout was reached.

View solution in original post

the_wolverine
Champion

Most likely you're hitting a timeout on the searchhead. The "timetaken=30.00" is a clue. The default receiveTimeout value is 30 (seconds) so increasing this value may resolve the situation. The value can be changed in $SPLUNK_HOME/etc/system/local/distsearch.conf:

[distributedSearch]
receiveTimeout = 120

In Splunk version 4.1.4, we will display a banner error in UI indicating that the receiveTimeout was reached.

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...