Reporting

Sendmail times out after 1 hour

lpino
Path Finder

Hi everyone,

I have an issue when trying to generate a scheduled view and send it via email.

Reading similar issues in the community, I set the following parameters in the savedsearches.conf file:

 

action.email.maxtime = 3600m
dispatch.max_time = 14400

 

increased the limits in limits.conf:

 

[pdf]
render_endpoint_timeout = 14400

[scheduler]
scheduled_view_timeout = 240m

 

and the splunkd timeout in web.conf:

 

splunkdConnectionTimeout = 14400

 

In other words, I tried to extend the timeout to 4 hours.

Nevertheless, after 1 hour the process tries to finalize the results and send the email, but it doesn't find any result and fails. This is the first line of the process inspector (see the timeout still set on 3600 seconds):

 

This search has completed in 3.608,538 seconds, but did not match any events

 


And this is the python.log (anonymized), see that seach starts at 12:00 and sendmail tries to send mail after 1 hour:

 

2020-11-09 12:00:48,466 +0100 INFO	sendemail:1149 - sendemail pdfgen_available = 1
2020-11-09 12:00:48,466 +0100 INFO	sendemail:1294 - sendemail:mail effectiveTime=1604919600
2020-11-09 13:00:48,502 +0100 ERROR	__init__:499 - Socket error communicating with splunkd (error=('The read operation timed out',)), path = /services/pdfgen/render
2020-11-09 13:00:48,503 +0100 ERROR	sendemail:1156 - An error occurred while generating a PDF: Failed to fetch PDF (SplunkdConnectionException): Splunkd daemon is not responding: ("Error connecting to /services/pdfgen/render: ('The read operation timed out',)",)
2020-11-09 13:00:48,503 +0100 INFO	sendemail:1175 - buildAttachments: not attaching csv as there are no results
2020-11-09 13:00:52,118 +0100 INFO	sendemail:134 - Sending email. subject="Splunk Dashboard: '<DASHBOARD_NAME>'", results_link="https://<SERVER_NAME>:8000/app/<app_name>/@go?sid=", recipients="[u'user_name@domain_name.it']", server="smtprelay.domain_name.it:25"

 

Has anybody ever had the same issue? Can anyone help me?

Thanks in advance.

Labels (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!