Sendmail times out after 1 hour


Hi everyone,

I have an issue when trying to generate a scheduled view and send it via email.

Reading similar issues in the community, I set the following parameters in the savedsearches.conf file: = 3600m
dispatch.max_time = 14400


increased the limits in limits.conf:


render_endpoint_timeout = 14400

scheduled_view_timeout = 240m


and the splunkd timeout in web.conf:


splunkdConnectionTimeout = 14400


In other words, I tried to extend the timeout to 4 hours.

Nevertheless, after 1 hour the process tries to finalize the results and send the email, but it doesn't find any result and fails. This is the first line of the process inspector (see the timeout still set on 3600 seconds):


This search has completed in 3.608,538 seconds, but did not match any events


And this is the python.log (anonymized), see that seach starts at 12:00 and sendmail tries to send mail after 1 hour:


2020-11-09 12:00:48,466 +0100 INFO	sendemail:1149 - sendemail pdfgen_available = 1
2020-11-09 12:00:48,466 +0100 INFO	sendemail:1294 - sendemail:mail effectiveTime=1604919600
2020-11-09 13:00:48,502 +0100 ERROR	__init__:499 - Socket error communicating with splunkd (error=('The read operation timed out',)), path = /services/pdfgen/render
2020-11-09 13:00:48,503 +0100 ERROR	sendemail:1156 - An error occurred while generating a PDF: Failed to fetch PDF (SplunkdConnectionException): Splunkd daemon is not responding: ("Error connecting to /services/pdfgen/render: ('The read operation timed out',)",)
2020-11-09 13:00:48,503 +0100 INFO	sendemail:1175 - buildAttachments: not attaching csv as there are no results
2020-11-09 13:00:52,118 +0100 INFO	sendemail:134 - Sending email. subject="Splunk Dashboard: '<DASHBOARD_NAME>'", results_link="https://<SERVER_NAME>:8000/app/<app_name>/@go?sid=", recipients="[u'']", server=""


Has anybody ever had the same issue? Can anyone help me?

Thanks in advance.

Labels (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!