Connection to <stack>.splunkcloud.com timed out

[cipher]

Hi all,
I’ve been using the Splunk API to fetch alert data via /search/jobs/{sid}/results. For authentication, I’m using a Splunk token. When I run my script to retrieve the data, I encounter the following error. However, if I rerun the code a few times, I’m eventually able to fetch the data successfully.

I’m confident this is not related to any firewall restrictions. Could someone please help me understand how to resolve this issue?

ERROR:app.services.splunk_connector:HTTPSConnectionPool(host='<stack>.splunkcloud.com', port=8089): Max retries exceeded with url: /services/search/jobs/{sid}/results?output_mode=csv&count=0&output_results_fields=%2A (Caused by ConnectTimeoutError(<HTTPSConnection(host='<stack>.splunkcloud.com', port=8089) at 0x20189cf1310>, 'Connection to <stack>.splunkcloud.com timed out. (connect timeout=None)'))

[isoutamo]

Have you tried to use curl with -v to get more information? And as @livehybrid said ensure that your nodes where you are running this script are using known IP.
Are you using proxy or other screening infra between you and SCP?
Is this gone broken or hasn’t worked ever?

[livehybrid]

Hi @cipher 

Its interesting that it works sometimes - I have seen this before when a customer hadnt allowed all the relevant IPs in the Search head IP allowlist (https://yourStack.splunkcloud.com/en-US/manager/search/manage_system_config/ip_allow_list)

Often organisations have an outbound proxy and/or pool of NAT IP addresses for outbound connections which means that each request could appear from a different IP address.  Are you able to confirm that all your organisation egress IPs are allowlisted against the Search Head API allow list? 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[cipher]

Hi @livehybrid , I’ve confirmed with my team that all egress IPs are allow‑listed against the Search Head API.

This setup was working fine earlier, but recently, when I attempted to run some automation, the issue appeared.

[inventsekar]

Hi @cipher 

i am not much sure of this issue, but i thought to suggest you...
for SplunkCloud, you could raise a Support ticket and you should receive good support from Splunk Support team. thanks.