Splunk Dev

Is there a way to set a timeout value to a Splunk connection using python SDK ?

timoti
Explorer

Hi, I have some problem to set a timeout value to Splunk connection with python SDK.

I'm using this :

self.service = client.connect(
host=self.SPLUNKSERVER,
port=self.SPLUNKPORT,
username=self.SPLUNKUSERNAME,
password=self.SPLUNKPASSWORD)
except Exception as e:
logging.info("Error connecting to the splunk platform : " + str(e))

But the default timeout value is 75 seconds, which is too long. Can't we set a timeout value in the parameters? Adding "timeout = 1" in the client.connect method's parameters doesn't have any effect.

Example: My Splunk server is at 192.168.1.10. When I try to connect 192.168.1.10 when the Splunk server is off, it takes 75 seconds to timeout, or if I set the IP to 192.168.1.11 ( a machine where there is no server at all ), it takes also 75 seconds to timeout.

The problem is that I have a UI where the user can type an IP address, and of course, i won't wait 75 seconds to inform the user that they typed a wrong IP address or that the server is not started.

I've searched on the Splunk documentation without results. Waiting for your help, thanks.

Labels (2)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @timoti,

Should be here :
https://docs.splunk.com/DocumentationStatic/PythonSDK/1.0/binding.html

splunklib.binding.handler(key_file=None, cert_file=None, timeout=None)

-key_file (string) – A path to a PEM (Privacy Enhanced Mail) formatted file containing your private key (optional).
-cert_file (string) – A path to a PEM (Privacy Enhanced Mail) formatted file containing a certificate chain file (optional).
-timeout (integer or “None”) – The request time-out period, in seconds (optional).

Let me know if that's what you're looking for.

Cheers,
David

View solution in original post

timoti
Explorer

Hi, thank's all, the solution was, as said below, to code an hanlder like that :
connectionHanlder = binding.handler(timeout = self.SPLUNK_TIMEOUT)

and then adding the hanlder to the connect method.

I won't change the python SDK because my program is for production and i wont install pythonsdk with pip and then modify it at every installation.

Thank's for the reply, cdt.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @timoti,

I don't see any way to do it outside the python-sdk, If you are okay to do minor change in your python SDK it can be done.

Search for below code in splunklib/binding.py:

if timeout is not None:
    connection.sock.settimeout(timeout)

And replace with:

connection.sock.settimeout(10)

Here "10" is 10 seconds timeout.

I recommended you test this first in your test environment. Hope this helps!!!

timoti
Explorer

Hello, thank's you for your reply, but the solution with the handler worked well, and i wont change my python sdk at every installation ( the code is for production, i will probably forgot to make this change at every deployment )
Cdt.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Yeah I understand that, that's why I mentioned in the answer. Thanks!!!

0 Karma

timoti
Explorer

Thank's for your response, for the others who are searching for the solution, I did this :

connectionHanlder = binding.handler(timeout = 1)
try:
self.service = client.connect(
host=self.SPLUNKSERVER,
port=self.SPLUNKPORT,
username=self.SPLUNKUSERNAME,
password=self.SPLUNKPASSWORD,
handler = connectionHanlder
)
except Exception as e:
logging.info("Error connecting to the splunk platform : " + str(e))

Would'nt it have been easier to set a "timeout = 1" parameter in the connect function ?

Have a nice day.

0 Karma

DavidHourani
Super Champion

Hi @timoti,

Should be here :
https://docs.splunk.com/DocumentationStatic/PythonSDK/1.0/binding.html

splunklib.binding.handler(key_file=None, cert_file=None, timeout=None)

-key_file (string) – A path to a PEM (Privacy Enhanced Mail) formatted file containing your private key (optional).
-cert_file (string) – A path to a PEM (Privacy Enhanced Mail) formatted file containing a certificate chain file (optional).
-timeout (integer or “None”) – The request time-out period, in seconds (optional).

Let me know if that's what you're looking for.

Cheers,
David

timoti
Explorer

Hey, thank you very much. For the ones who have the same problem, here's the solution :

I created a hanlder, then put the handler in parameter of the connect method.

It would have been easier to have a "timeout" parameter in the connect method, but well.

connectionHanlder = binding.handler(timeout = self.SPLUNK_TIMEOUT)
try:
self.service = client.connect(
host=self.SPLUNKSERVER,
port=self.SPLUNKPORT,
username=self.SPLUNKUSERNAME,
password=self.SPLUNKPASSWORD,
handler = connectionHanlder
)
except Exception as e:
logging.info("Error connecting to the splunk platform : " + str(e))

0 Karma

DavidHourani
Super Champion

nicely done, glad I could help!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...