Getting Data In

REST api export hangs

conklirb
New Member

I'm using the REST API search/jobs/export search endpoint. The search takes over an hour to complete successfully (I can view through the Spunk GUI), but when it finishes the results are not sent back via the api call. Curl is just stuck waiting for the results. No timeout or connect errors are reported back from the api. The same query works on every index we have, except one of our larger indexes. I'm assuming that some sort of timeout threshold is reached, but I would have expected an error back from the api.

0 Karma

dchoi_splunk
Splunk Employee
Splunk Employee

Based on the description, the sessionTimeout should be configured longer than the search runtime.
Can you try sessionTimeout=2h?

Under server.conf
[general]
sessionTimeout = [s|m|h|d]
* The amount of time before a user session times out, expressed as a search-like time range.
* Examples include "24h" (24 hours), "3d" (3 days), "7200s" (7200 seconds, or two hours)
* Default: "1h" (1 hour)

Also, It's worth while considering to increase timeout value below:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Webconf

server.socket_timeout =
* The timeout, in seconds, for accepted connections between the browser and Splunk Web
* Default: 10

export_timeout =
* When exporting results, the number of seconds the server waits before closing the connection with splunkd.
* If you do not set a value for export_timeout, Splunk Web uses the value for the 'splunkdConnectionTimeout' setting.
* Set 'export_timeout' to a value greater than 30 in normal operations.
* No default.

Splunk will be logging the REST API export activities in the splunkd_access.log

Hope it help.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...