Since yesterday, when I add data into Splunk and choose "Preview data before indexing" this error message appears:
Splunkd daemon is not responding: ('Error connecting to /servicesNS/-/-/indexing/preview: The read operation timed out',)
Before yesterday the preview worked on the same data.
1- copy web.conf from C:\Program Files\Splunk\etc\system\default to C:\Program Files\Splunk\etc\system\local
2- increase this attribute in the file
splunkdConnectionTimeout = (default 30 secs)
3-save and restart splunk.
Now it works!
But I don't understand why that error occours..
And today don't work again!