Getting Data In

REST api export hangs

conklirb
New Member

I'm using the REST API search/jobs/export search endpoint. The search takes over an hour to complete successfully (I can view through the Spunk GUI), but when it finishes the results are not sent back via the api call. Curl is just stuck waiting for the results. No timeout or connect errors are reported back from the api. The same query works on every index we have, except one of our larger indexes. I'm assuming that some sort of timeout threshold is reached, but I would have expected an error back from the api.

0 Karma

dchoi_splunk
Splunk Employee
Splunk Employee

Based on the description, the sessionTimeout should be configured longer than the search runtime.
Can you try sessionTimeout=2h?

Under server.conf
[general]
sessionTimeout = [s|m|h|d]
* The amount of time before a user session times out, expressed as a search-like time range.
* Examples include "24h" (24 hours), "3d" (3 days), "7200s" (7200 seconds, or two hours)
* Default: "1h" (1 hour)

Also, It's worth while considering to increase timeout value below:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Webconf

server.socket_timeout =
* The timeout, in seconds, for accepted connections between the browser and Splunk Web
* Default: 10

export_timeout =
* When exporting results, the number of seconds the server waits before closing the connection with splunkd.
* If you do not set a value for export_timeout, Splunk Web uses the value for the 'splunkdConnectionTimeout' setting.
* Set 'export_timeout' to a value greater than 30 in normal operations.
* No default.

Splunk will be logging the REST API export activities in the splunkd_access.log

Hope it help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...