HTTP Client Timeout

[hkaiser]

Hello,

during evaluation of Splunk I created a new data model, called NG_Events.
A report has been scheduled every 15 Minutes.
The issue: Every time the scheduled search is executed by the scheduler, the following messages are logged into splunkd.log:

12-05-2013 08:30:08.336 +0000 WARN NetUtils - select_for timeout hit waiting for read
12-05-2013 08:30:08.336 +0000 WARN NetUtils - Bad select_for_loop rv = -2
12-05-2013 08:30:08.337 +0000 ERROR HTTPClient - Should have gotten at least 3 tokens in status line, while getting response code. Only got 0.
12-05-2013 08:30:08.337 +0000 WARN HTTPClient - Read from=127.0.0.1:8004 timed out; exceeded 5sec
12-05-2013 08:30:08.337 +0000 ERROR PivotProcessor - Unable to fetch datamodelreport REST endpoint '/servicesNS/admin/search/datamodel/pivot/NG_Events' from 'https://127.0.0.1:8004'
12-05-2013 08:30:08.706 +0000 WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/search/datamodel/pivot/NG_Events: Broken pipe

Although I have found similar timeout error already mentioned in other entries on this forum, there was never a solution provided to this problem.

In my case this looks just like a simple timeout of the HTTP Client and I would like to extend the timeout. The machine hosting the instance is also under some load.
If I schedule the report to run every minute, than the error pops up only every third time the scheduled search is executed.
Looking at server.conf I could not identify any setting, that would increase the HTTPClient timeout.
Is there any way to increase the timeout for HTTP Client?
Thanks

[rakeshh123 · Accepted solution]

Splunk user's session times out has three timeout settings:

splunkweb session timeout.
splunkd session timeout.
browser session timeout.

The splunkweb and splunkd timeouts determine the maximum idle time in the interaction between browser and Splunk.......
splunkweb and splunkd timeouts generally have the same value, as the same field sets both of them. ....for this u have to go to
Settings--------------->General Settings---------------->Session timeout --------->generally default value is 1h------> change it to 6h or more.........

[bohanlon_splunk]

Is your server oversubscribed like this post mentions:
https://answers.splunk.com/answers/217/error-httpclient-should-have-gotten-at-least-3-tokens-in-stat...

Splunk on splunk might be a nice way to figure out if it is:
https://splunkbase.splunk.com/app/748/

[bigtyma]

Did you find a solution?