Security

SPLUNKD_CONNECTION_TIMEOUT 6.x

RicoSuave
Builder

In previous versions of splunk, we have overridden the SPLUNKD_CONNECTION_TIMEOUT value in the __init__.py file due to long waits on our UI. I am currently working on applying our changes in Version 5 and making them "work" for Version 6. I am looking to apply this change, but I see the following comment about that parameter in the file:

# while this is no longer a constant, we don't know if any externally developed modules were referring
# directly to the constant, so leave the variable in constant ALL-CAPS style
SPLUNKD_CONNECTION_TIMEOUT = 30

I am concerned mostly because it says "this is no longer a constant". Is this just because I can pass timeout in with my rest call now? Looking at the code, it seems that if timeout is not set, then it will use the value for SPLUNKD_CONNECTION_TIMEOUT. I want to make sure that splunk doesn't set this anywhere else (that we would need to change) when it does its own internal rest calls.

Tags (1)
1 Solution

RicoSuave
Builder

Now configurable in web.conf. From web.conf.spec:

splunkdConnectionTimeout = <integer>
    * Number of seconds to wait before timing out when communicating with splunkd
    * Must be at least 30
    * Values smaller than 30 will be ignored, resulting in the use of the default value
    * Defaults to 30

View solution in original post

RicoSuave
Builder

Now configurable in web.conf. From web.conf.spec:

splunkdConnectionTimeout = <integer>
    * Number of seconds to wait before timing out when communicating with splunkd
    * Must be at least 30
    * Values smaller than 30 will be ignored, resulting in the use of the default value
    * Defaults to 30
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...