Distributed Search Configuration - sendRcvTimeout

[JohnEGones]

Hi all,

Do any of you all run into issues where the bundle replication keeps timing out and splunkd.log references increasing the sendRcvTimeout parameter, in a previous ticket with support, they supplied a Golden Configuration that says that this value should be around 180.

Based on: https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Distsearchconf

Under, 'classic' REPLICATION-SPECIFIC SETTINGS

connectionTimeout = <integer>
* The maximum amount of time to wait, in seconds, before a search head's initial
  connection to a peer times out.
* Default: 60

sendRcvTimeout = <integer>
* The maximum amount of time to wait, in seconds, when a search head is sending
  a full replication to a peer.
* Default: 60

Should these two values be adjusted and kept in-sync?

I am considering adding another 30 seconds to each.

Or, if there is something else I should be verifying first, it would be helpful to get some direction here.

[richgalloway · Accepted solution]

Those two timeouts do not need to match.  Sixty seconds should be more than enough time to establish a connection.  More may be needed to send a bundle, however.

The bigger question is *why* is the delivery timing out?  Perhaps the bundle is too large.  If so, you should work on making it smaller (look at large lookup files first).