Getting Data In

REST api export hangs

conklirb
New Member

I'm using the REST API search/jobs/export search endpoint. The search takes over an hour to complete successfully (I can view through the Spunk GUI), but when it finishes the results are not sent back via the api call. Curl is just stuck waiting for the results. No timeout or connect errors are reported back from the api. The same query works on every index we have, except one of our larger indexes. I'm assuming that some sort of timeout threshold is reached, but I would have expected an error back from the api.

0 Karma

dchoi_splunk
Splunk Employee
Splunk Employee

Based on the description, the sessionTimeout should be configured longer than the search runtime.
Can you try sessionTimeout=2h?

Under server.conf
[general]
sessionTimeout = [s|m|h|d]
* The amount of time before a user session times out, expressed as a search-like time range.
* Examples include "24h" (24 hours), "3d" (3 days), "7200s" (7200 seconds, or two hours)
* Default: "1h" (1 hour)

Also, It's worth while considering to increase timeout value below:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Webconf

server.socket_timeout =
* The timeout, in seconds, for accepted connections between the browser and Splunk Web
* Default: 10

export_timeout =
* When exporting results, the number of seconds the server waits before closing the connection with splunkd.
* If you do not set a value for export_timeout, Splunk Web uses the value for the 'splunkdConnectionTimeout' setting.
* Set 'export_timeout' to a value greater than 30 in normal operations.
* No default.

Splunk will be logging the REST API export activities in the splunkd_access.log

Hope it help.

0 Karma
Get Updates on the Splunk Community!

Manual Instrumentation with Splunk Observability Cloud: The What and Why

If you've ever worked with distributed systems, you’ve likely felt the pain of a frontend throwing errors, ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...