Splunk Dev

Submitting events to an index: even when no errors are returned, not all events are found on Splunk.

paulomenezes
Engager

Hello, guys!

Well, I'm trying to send data to a Splunk index via Splunk SDK for NodeJS.

The thing is: randomly, I was receiving this error for some events:
Error: connect ECONNRESET 127.0.0.1:8089 at TCPConnectWrap.afterConnect [as oncomplete]

Ok, then I implemented a retrial mechanism for that error. It seemed to work, since I could send much more data to Splunk than ever. But, still, not all data are sent. And worst, no error is returned on callback.
I thought it could be concurrency, then I created a submission pool which only submits 500 events max (I even tried with 10 lol) concurrently. Nothing changed.

Out of 32k records, only between 25k and 28k are properly sent to Splunk.

Have you guys ever been through this situation?
Thanks in advance.

0 Karma

bjoernjensen
Contributor

Hey,

"ECONNRESET" points out, that the receiving side rudely closed its end of the TCP connection.

Could the index be overloaded and simply kills the connection as a result? Are there any hints in your splunkd.log?

Cheerz,
Björn

paulomenezes
Engager

Hey, Bjorn!
Well, nothing is logged on splunkd.log when the error is raised.

Could this error happen due to too many data being sent to the index in a short period of time? I'll try to give some time to the index to breathe between batches' execution.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...