Getting Data In

REST api export hangs

conklirb
New Member

I'm using the REST API search/jobs/export search endpoint. The search takes over an hour to complete successfully (I can view through the Spunk GUI), but when it finishes the results are not sent back via the api call. Curl is just stuck waiting for the results. No timeout or connect errors are reported back from the api. The same query works on every index we have, except one of our larger indexes. I'm assuming that some sort of timeout threshold is reached, but I would have expected an error back from the api.

0 Karma

dchoi_splunk
Splunk Employee
Splunk Employee

Based on the description, the sessionTimeout should be configured longer than the search runtime.
Can you try sessionTimeout=2h?

Under server.conf
[general]
sessionTimeout = [s|m|h|d]
* The amount of time before a user session times out, expressed as a search-like time range.
* Examples include "24h" (24 hours), "3d" (3 days), "7200s" (7200 seconds, or two hours)
* Default: "1h" (1 hour)

Also, It's worth while considering to increase timeout value below:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Webconf

server.socket_timeout =
* The timeout, in seconds, for accepted connections between the browser and Splunk Web
* Default: 10

export_timeout =
* When exporting results, the number of seconds the server waits before closing the connection with splunkd.
* If you do not set a value for export_timeout, Splunk Web uses the value for the 'splunkdConnectionTimeout' setting.
* Set 'export_timeout' to a value greater than 30 in normal operations.
* No default.

Splunk will be logging the REST API export activities in the splunkd_access.log

Hope it help.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...