Reporting

Sendmail times out after 1 hour

lpino
Path Finder

Hi everyone,

I have an issue when trying to generate a scheduled view and send it via email.

Reading similar issues in the community, I set the following parameters in the savedsearches.conf file:

 

action.email.maxtime = 3600m
dispatch.max_time = 14400

 

increased the limits in limits.conf:

 

[pdf]
render_endpoint_timeout = 14400

[scheduler]
scheduled_view_timeout = 240m

 

and the splunkd timeout in web.conf:

 

splunkdConnectionTimeout = 14400

 

In other words, I tried to extend the timeout to 4 hours.

Nevertheless, after 1 hour the process tries to finalize the results and send the email, but it doesn't find any result and fails. This is the first line of the process inspector (see the timeout still set on 3600 seconds):

 

This search has completed in 3.608,538 seconds, but did not match any events

 


And this is the python.log (anonymized), see that seach starts at 12:00 and sendmail tries to send mail after 1 hour:

 

2020-11-09 12:00:48,466 +0100 INFO	sendemail:1149 - sendemail pdfgen_available = 1
2020-11-09 12:00:48,466 +0100 INFO	sendemail:1294 - sendemail:mail effectiveTime=1604919600
2020-11-09 13:00:48,502 +0100 ERROR	__init__:499 - Socket error communicating with splunkd (error=('The read operation timed out',)), path = /services/pdfgen/render
2020-11-09 13:00:48,503 +0100 ERROR	sendemail:1156 - An error occurred while generating a PDF: Failed to fetch PDF (SplunkdConnectionException): Splunkd daemon is not responding: ("Error connecting to /services/pdfgen/render: ('The read operation timed out',)",)
2020-11-09 13:00:48,503 +0100 INFO	sendemail:1175 - buildAttachments: not attaching csv as there are no results
2020-11-09 13:00:52,118 +0100 INFO	sendemail:134 - Sending email. subject="Splunk Dashboard: '<DASHBOARD_NAME>'", results_link="https://<SERVER_NAME>:8000/app/<app_name>/@go?sid=", recipients="[u'user_name@domain_name.it']", server="smtprelay.domain_name.it:25"

 

Has anybody ever had the same issue? Can anyone help me?

Thanks in advance.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...