Why am I getting "Socket error communicating with splunkd" when I try to reload my deployment server to push out new configurations?

[JoeSco27]

Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/config/_reload

I get this error whenever i try to reload my deployment server to push out new configs. It wont let me make any changes. I have opened up a ticket with Splunk support (Case# - 201659) but to no avail. Has anyone else seen this type of issue and know how to fix it or what is causing the issue?

[shaikhussain2]

Hi, This might be in your environment using in 1 server 2 components such like we were using 2 component in 1 server ( SH & DS ), so we have faced same issue and then separated both in separate servers and then the command was executing perfectly.

[mookiie2005]

This happened to us a lot after we upgraded to splunk 6.4 version, We ended up needing to use the deployment command "splunk reload deploy-server -timeout 200" where 200 is 200 seconds. You are just telling splunk to give the deployment a little more time before it times out. This could be required if you are deploying a large number of apps to a large number of servers. Hope that helps!

[hortonew]

This is the answer that solved my problem. Just add the -timeout 200 and no issues.

[hettervik]

Hi. Has anyone figured what causes the socket error message? I'm getting the same error, but I feel like adding the timeout flag on the reload deploy-server command is just hiding the problem, not actually fixing it. I've noticed that almost all my RAM is used for cache, but I don't know if this is related or not.

[splunkoptimus]

Reloading servers can take a bit more time if your environment is big. that is you have thousands of forwarders connecting to your DS.

[shaikhussain2]

same issue i am facing now aslo i have tried with -timeout 200 but still socket error message it showing

[cesaccenturefed]

Thank this also help me too. I was running into the issue 2 years ago decided just to ignore it. the flag provides so much satisfaction to get successful reloading message 🙂

[LiquidTension]

I have the same problem. Take a look at this posting:

http://answers.splunk.com/answers/170244/splunk-reload-deploy-server%E3%82%92%E5%AE%9F%E8%A1%8C%E3%8...

The above does not work for me, I end up being presented with the following:
"Too many HTTP threads (659) already running, try again later

The server can not presently handle the given request."

Did you ever find a solution?

[itmonitoring]

Restart splunkd of the deployment server should fix the problem. But i am not sure what exactly caused this error yet. Anyone knows about the root cause of this error?