Recommendations for Splunkd daemon error?

[JohnHC]

All,

I am having an issue with splunk and uploading Pcap files to the server we are running on prem. When I attempt to upload a Pcap file via the data inputs option I receive the following error. 

Encountered the following error while trying to save: Splunkd daemon is not responding: ('Error connecting to /servicesNS/admin/launcher/data/inputs/upload_pcap: The read operation timed out',)

My thinking is it could be too big and is timing out the daemon. If that is the case can this timeout be edited? 

Pcap files are in the 139MB size range. 

Thank you for any recommendations or insight. 

[scelikok]

Hi @JohnHC,

That cli command is the same function as uploading using GUI. You can set index and sourcetype if you will.

As a sample;

[root@myserver bin] ./streamfwd -r my.pcap --index pcap_index

[scelikok]

Hi @JohnHC,

If you have access to command line you can try cli commands;

[root@myserver bin] ./streamfwd -r my.pcap

https://docs.splunk.com/Documentation/StreamApp/8.1.0/DeployStreamApp/streamfwdcommandlineoptions#Re...

[JohnHC]

That command is not an issue. We are attempting to input the pcap file into the input data field so other users can perform searches from the Splunk search GUI.  We are attempting to upload the files here and are getting the error.