Getting Data In

REST api export hangs

conklirb
New Member

I'm using the REST API search/jobs/export search endpoint. The search takes over an hour to complete successfully (I can view through the Spunk GUI), but when it finishes the results are not sent back via the api call. Curl is just stuck waiting for the results. No timeout or connect errors are reported back from the api. The same query works on every index we have, except one of our larger indexes. I'm assuming that some sort of timeout threshold is reached, but I would have expected an error back from the api.

0 Karma

dchoi_splunk
Splunk Employee
Splunk Employee

Based on the description, the sessionTimeout should be configured longer than the search runtime.
Can you try sessionTimeout=2h?

Under server.conf
[general]
sessionTimeout = [s|m|h|d]
* The amount of time before a user session times out, expressed as a search-like time range.
* Examples include "24h" (24 hours), "3d" (3 days), "7200s" (7200 seconds, or two hours)
* Default: "1h" (1 hour)

Also, It's worth while considering to increase timeout value below:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Webconf

server.socket_timeout =
* The timeout, in seconds, for accepted connections between the browser and Splunk Web
* Default: 10

export_timeout =
* When exporting results, the number of seconds the server waits before closing the connection with splunkd.
* If you do not set a value for export_timeout, Splunk Web uses the value for the 'splunkdConnectionTimeout' setting.
* Set 'export_timeout' to a value greater than 30 in normal operations.
* No default.

Splunk will be logging the REST API export activities in the splunkd_access.log

Hope it help.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In March, the Splunk Threat Research Team had 2 releases of security content via the Enterprise Security ...

Join the Splunk Developer Program Hackathon: Splunk Build-a-thon!

The Splunk Developer Program is launching in beta, and we’re celebrating with an exciting hackathon! This is ...

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...