Why does Splunk DB Connect 1 time out when adding a database input?

[tweaktubbie]

Created multiple inputs on the same database today, but trying to add one resulted in:

Encountered the following error while trying to save: Splunkd daemon is not responding: ('Error connecting to /servicesNS/#/dbx/dbx/dbmon: The read operation timed out',)

Running it in DB Query works, though the query takes 2-3 minutes to complete. So yes, it works, but I can't add it through the web interface because the validation/check obviously times out.

Is there some requirement I'm not aware of or can't find on Answers, or is there some blocking configuration setting? Of course, performance and load is something to keep in mind, but if the query is needed by our business team, it must somehow be there 😉

[jcoates_splunk]

are you on Windows?

Alternatively, we might be able to work something out with a guard's security band, a quarnex battery, and that guy's prosthetic leg...

[pcarey]

seeing the same thing here, 'read operation timed out'
only on large 2-3 minute queries in db connect - the queries work perfectly in SQL.

[tweaktubbie]

No, it's on Linux/RedHat. By the way I'm wondering if after adding a dummy query, somehow in a configuration file editing the query is possible. When creating a data source skipping validation is an option, with adding a data input it isn't. Perhaps rewriting it in a report with valid query/stanza is an option, but that would break with the idea of one central place for all db queries from Splunk.