Security

SplunkWeb - Your network connection may have been lost or Splunk web may be down?

Michael_Wilde
Splunk Employee
Splunk Employee

Whats the deal with that error? What is splunk doing when that happens? Assuming its making some sort of connection to "splunkd", can i control the timeout?

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

It means the browser lost the ability to talk to SplunkWeb for more than some number of seconds.

More literally it means an HTTP request reported http status code 0, which is the browsers way of telling us that it never heard back. Im not sure how many seconds it takes of total silence before the browser gives up but I'm pretty sure it's not configurable.

Assuming someone didnt actually restart SplunkWeb out from under you, it sounds like your server or maybe just SplunkWeb, is extremely busy. I get this once in a while too.

View solution in original post

ii_splunk
Path Finder

I have just recently started getting this message and it seems to be correlated to these messages in the splunkd.log:

08-02-2012 13:47:07.449 WARN metadata - Could not retrieve totalCount value for a row of type 'sourcetype'. Skipping.
08-02-2012 13:47:09.847 WARN metadata - Could not retrieve totalCount value for a row of type 'sourcetype'. Skipping.
08-02-2012 13:47:13.756 WARN metadata - Could not retrieve totalCount value for a row of type 'source'. Skipping.
08-02-2012 13:47:16.086 WARN metadata - Could not retrieve totalCount value for a row of type 'source'. Skipping.

I only get this on the Summary page. Could my metadata be corrupt? If so how can I fix this?

0 Karma

sideview
SplunkTrust
SplunkTrust

It means the browser lost the ability to talk to SplunkWeb for more than some number of seconds.

More literally it means an HTTP request reported http status code 0, which is the browsers way of telling us that it never heard back. Im not sure how many seconds it takes of total silence before the browser gives up but I'm pretty sure it's not configurable.

Assuming someone didnt actually restart SplunkWeb out from under you, it sounds like your server or maybe just SplunkWeb, is extremely busy. I get this once in a while too.

sideview
SplunkTrust
SplunkTrust

hahaha... nice. Yea its a pretty useful hack. Shame there's not a better way. (Nag somebody!)

0 Karma

Michael_Wilde
Splunk Employee
Splunk Employee

i see an argh filter coming my way!

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...