SplunkWeb - Your network connection may have been lost or Splunk web may be down?

[Michael_Wilde]

Whats the deal with that error? What is splunk doing when that happens? Assuming its making some sort of connection to "splunkd", can i control the timeout?

[ii_splunk]

I have just recently started getting this message and it seems to be correlated to these messages in the splunkd.log:

08-02-2012 13:47:07.449 WARN metadata - Could not retrieve totalCount value for a row of type 'sourcetype'. Skipping.
08-02-2012 13:47:09.847 WARN metadata - Could not retrieve totalCount value for a row of type 'sourcetype'. Skipping.
08-02-2012 13:47:13.756 WARN metadata - Could not retrieve totalCount value for a row of type 'source'. Skipping.
08-02-2012 13:47:16.086 WARN metadata - Could not retrieve totalCount value for a row of type 'source'. Skipping.

I only get this on the Summary page. Could my metadata be corrupt? If so how can I fix this?

[sideview · Accepted solution]

It means the browser lost the ability to talk to SplunkWeb for more than some number of seconds.

More literally it means an HTTP request reported http status code 0, which is the browsers way of telling us that it never heard back. Im not sure how many seconds it takes of total silence before the browser gives up but I'm pretty sure it's not configurable.

Assuming someone didnt actually restart SplunkWeb out from under you, it sounds like your server or maybe just SplunkWeb, is extremely busy. I get this once in a while too.

[sideview]

hahaha... nice. Yea its a pretty useful hack. Shame there's not a better way. (Nag somebody!)

[Michael_Wilde]

i see an argh filter coming my way!