Getting Data In

Why is the summary index backfill script failing to run and says timeout?

Prakash493
Communicator

Hi , i am running the script for summary indexing backfill , after running few times its getting failed says time out ? what will be the issue ?

le "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 500, in simpleRequest
    raise splunk.SplunkdConnectionException,  'Error connecting to %s: %s' % (path, str(e))
splunk.SplunkdConnectionException: Splunkd daemon is not responding: ("Error connecting to /servicesNS/dgk1/search/saved/searches , The read operation timeout
0 Karma
1 Solution

codebuilder
Influencer

The summarization search is timing out before it can complete.
Decrease your time range or increase your parallel summarization threads.

To do that you would increase (or set) the value of auto_summarize.max_concurrent in savedsearches.conf
The default value is 1, so I would start by setting it to 2 then re-evaluate performance.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
Influencer

The summarization search is timing out before it can complete.
Decrease your time range or increase your parallel summarization threads.

To do that you would increase (or set) the value of auto_summarize.max_concurrent in savedsearches.conf
The default value is 1, so I would start by setting it to 2 then re-evaluate performance.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

Prakash493
Communicator

Thank you so much for info

0 Karma

codebuilder
Influencer

Sure, glad to help!

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...