Security

SPLUNKD_CONNECTION_TIMEOUT 6.x

RicoSuave
Builder

In previous versions of splunk, we have overridden the SPLUNKD_CONNECTION_TIMEOUT value in the __init__.py file due to long waits on our UI. I am currently working on applying our changes in Version 5 and making them "work" for Version 6. I am looking to apply this change, but I see the following comment about that parameter in the file:

# while this is no longer a constant, we don't know if any externally developed modules were referring
# directly to the constant, so leave the variable in constant ALL-CAPS style
SPLUNKD_CONNECTION_TIMEOUT = 30

I am concerned mostly because it says "this is no longer a constant". Is this just because I can pass timeout in with my rest call now? Looking at the code, it seems that if timeout is not set, then it will use the value for SPLUNKD_CONNECTION_TIMEOUT. I want to make sure that splunk doesn't set this anywhere else (that we would need to change) when it does its own internal rest calls.

Tags (1)
1 Solution

RicoSuave
Builder

Now configurable in web.conf. From web.conf.spec:

splunkdConnectionTimeout = <integer>
    * Number of seconds to wait before timing out when communicating with splunkd
    * Must be at least 30
    * Values smaller than 30 will be ignored, resulting in the use of the default value
    * Defaults to 30

View solution in original post

RicoSuave
Builder

Now configurable in web.conf. From web.conf.spec:

splunkdConnectionTimeout = <integer>
    * Number of seconds to wait before timing out when communicating with splunkd
    * Must be at least 30
    * Values smaller than 30 will be ignored, resulting in the use of the default value
    * Defaults to 30
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...