Knowledge Management

kvstore query via Python SDK on Windows is slow

David
Splunk Employee
Splunk Employee

It seems like the python SDK for Windows is timing out when trying to connect to the host. I have a rest endpoint that makes 7 kvstore calls, and each one adds 2 seconds to the execution time. On linux, all seven complete in less than half a second. How do I work around this?

0 Karma

David
Splunk Employee
Splunk Employee

Answer — at least as tested on Windows 2019 in AWS, with the current Python SDK (updated ~ 1 mon ago), you have to pass the host and port or it will timeout on every single query. This is different from OSX and Linux where it just works.

Notably, the only other issue I've had with the kvstore SDK not working was on a OSX host where localhost wasn't configured in etc hosts. This configuration would have also solved that issue (as everything I did was based on 127.0.0.1 -- dev host).

Workaround:

    try:
        # Getting configurations
        mgmtHostname, mgmtHostPort = getConfKeyValue('web', 'settings', 'mgmtHostPort').split(":")
        base_url = "https://" + mgmtHostname + ":" + mgmtHostPort
    except Exception as e:
        debug.append(json.dumps({"status": "ERROR", "description": "Error getting the base_url configuration!", "message": str(e)}))

    try: 
        service = client.connect(host=mgmtHostname, port=mgmtHostPort, token=sessionKey)
        service.namespace['owner'] = 'nobody'
        service.namespace['app'] = 'Splunk_Security_Essentials'
    except Exception as e:
        debug.append(json.dumps({"status": "ERROR", "description": "Error grabbing a service object", "message": str(e)}))

    def getKVStoreById(store, id):
        try:
            kvstore_output = service.kvstore[store].data.query_by_id(id)
            debug.append({"message": "I got a kvstorebyid request", "store": store, "id": id, "returningkey": kvstore_output["_key"]})
        except Exception as e:
            debug.append({"status": "Failed to do primary method": str(e)})
            kvstore_output = []
        return kvstore_output
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...