Reporting

How to change 5 minute timeout on script run from saved search?

wyfwa4
Communicator

I have a saved search which runs every day and this calls a script through a windows batch file. This is triggered successfully each day, but the script is killed after 300 seconds. The script does start and generate some data, so the script is working as expected, it just needs more time to complete.

WARN script - Script has timed out and will be killed, maxtime=300sec

Is there a way to modify the timelimit for a script? I can't see anything linked with saved searches or scripted inputs in the limits.conf which specifically mentions this limit.

Labels (1)

garias_splunk
Splunk Employee
Splunk Employee

That timeout can be increased in alert_action.conf

https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Alertactionsconf

maxtime = <integer>[m|s|h|d]
* The maximum amount of time that the execution of an action is allowed to
  take before the action is aborted.
* Use the d, h, m and s suffixes to define the period of time:
  d = day, h = hour, m = minute and s = second.
  For example: 5d means 5 days.
* Default (for all stanzas except 'rss': 5m
* Default (for the 'rss' stanza): 1m

 

0 Karma

woodcock
Esteemed Legend

You can have the script write to a file, do an exec inside the script to spawn the slow part as a separate process and configure a [monitor://...] input to pull in the file changes.

0 Karma

abhinav_singh
Loves-to-Learn

Hi
Can you please elaborate the steps of what you are advising to do?

0 Karma

wyfwa4
Communicator

Thanks for the suggestion. I am currently using another workaround by running the script via inputs.conf as a scripted input.
So I specifically looking for an answer to the question of the modifying the timeout - either it can be changed by or it is fixed and cannot be changed?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...