Monitoring Splunk

HTTP Client Timeout

hkaiser
Path Finder

Hello,

during evaluation of Splunk I created a new data model, called NG_Events.
A report has been scheduled every 15 Minutes.
The issue: Every time the scheduled search is executed by the scheduler, the following messages are logged into splunkd.log:

12-05-2013 08:30:08.336 +0000 WARN NetUtils - select_for timeout hit waiting for read
12-05-2013 08:30:08.336 +0000 WARN NetUtils - Bad select_for_loop rv = -2
12-05-2013 08:30:08.337 +0000 ERROR HTTPClient - Should have gotten at least 3 tokens in status line, while getting response code. Only got 0.
12-05-2013 08:30:08.337 +0000 WARN HTTPClient - Read from=127.0.0.1:8004 timed out; exceeded 5sec
12-05-2013 08:30:08.337 +0000 ERROR PivotProcessor - Unable to fetch datamodelreport REST endpoint '/servicesNS/admin/search/datamodel/pivot/NG_Events' from 'https://127.0.0.1:8004'
12-05-2013 08:30:08.706 +0000 WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/search/datamodel/pivot/NG_Events: Broken pipe

Although I have found similar timeout error already mentioned in other entries on this forum, there was never a solution provided to this problem.

In my case this looks just like a simple timeout of the HTTP Client and I would like to extend the timeout. The machine hosting the instance is also under some load.
If I schedule the report to run every minute, than the error pops up only every third time the scheduled search is executed.
Looking at server.conf I could not identify any setting, that would increase the HTTPClient timeout.
Is there any way to increase the timeout for HTTP Client?
Thanks

0 Karma
1 Solution

rakeshh123
Path Finder

Splunk user's session times out has three timeout settings:

splunkweb session timeout.
splunkd session timeout.
browser session timeout.

The splunkweb and splunkd timeouts determine the maximum idle time in the interaction between browser and Splunk.......
splunkweb and splunkd timeouts generally have the same value, as the same field sets both of them. ....for this u have to go to
Settings--------------->General Settings---------------->Session timeout --------->generally default value is 1h------> change it to 6h or more.........

View solution in original post

rakeshh123
Path Finder

Splunk user's session times out has three timeout settings:

splunkweb session timeout.
splunkd session timeout.
browser session timeout.

The splunkweb and splunkd timeouts determine the maximum idle time in the interaction between browser and Splunk.......
splunkweb and splunkd timeouts generally have the same value, as the same field sets both of them. ....for this u have to go to
Settings--------------->General Settings---------------->Session timeout --------->generally default value is 1h------> change it to 6h or more.........

bohanlon_splunk
Splunk Employee
Splunk Employee

Is your server oversubscribed like this post mentions:
https://answers.splunk.com/answers/217/error-httpclient-should-have-gotten-at-least-3-tokens-in-stat...

Splunk on splunk might be a nice way to figure out if it is:
https://splunkbase.splunk.com/app/748/

bigtyma
Communicator

Did you find a solution?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...